[SECURITY] [DLA 548-1] drupal7 security update

2016-07-1118:28:22

lists.debian.org

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

60.7%

JSON

Package : drupal7
Version : 7.14-2+deb7u13
CVE ID : CVE-2015-7943

It was discovered that there was an open redirect vulnerability in drupal7,
a content management framework.

The "Overlay" module in Drupal core displays administrative pages as a layer
over the current page (using JavaScript) rather than replacing the page
in the browser window. The module did not sufficiently validate URLs prior
to displaying their contents, leading to an open redirect vulnerability.

For Debian 7 "Wheezy", this issue has been fixed in drupal7 version
7.14-2+deb7u13.

We recommend that you upgrade your drupal7 packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian7alldrupal7< 7.14-2+deb7u13drupal7_7.14-2+deb7u13_all.deb
Debian8alldrupal7< 7.32-1+deb8u9drupal7_7.32-1+deb8u9_all.deb