drupal6 - multiple vulnerabilities

Multiple vulnerabilities have been discovered in drupal, a web content
management system. The Common Vulnerabilities and Exposures
project identifies the following problems:

• CVE-2009-1575
  pod.Edge discovered a cross-site scripting vulnerability due that can be
  triggered when some browsers interpret UTF-8 strings as UTF-7 if they
  appear before the generated HTML document defines its Content-Type.
  This allows a malicious user to execute arbitrary javascript in the
  context of the web site if they’re allowed to post content.
• CVE-2009-1576
  Moritz Naumann discovered an information disclosure vulnerability. If
  a user is tricked into visiting the site via a specially crafted URL
  and then submits a form (such as the search box) from that page, the
  information in their form submission may be directed to a third-party
  site determined by the URL and thus disclosed to the third party. The
  third party site may then execute a cross-site request forgery attack
  against the submitted form.

The old stable distribution (etch) does not contain drupal and is not
affected.

For the stable distribution (lenny), these problems have been fixed in version
6.6-3lenny1.

For the unstable distribution (sid), these problems have been fixed in
version 6.11-1

We recommend that you upgrade your drupal6 package.