Several vulnerabilities have been found in drupal6, a fully-featured
content management framework. The Common Vulnerabilities and Exposures
project identifies the following problems:
Several design flaws in the OpenID module have been fixed, which could
lead to cross-site request forgeries or privilege escalations. Also, the
file upload function does not process all extensions properly leading
to the possible execution of arbitrary code.
(SA-CORE-2009-008)
The oldstable distribution (etch) does not contain drupal6.
For the stable distribution (lenny), these problems have been fixed in
version 6.6-3lenny3.
For the testing distribution (squeeze) and the unstable distribution
(sid), these problems have been fixed in version 6.14-1.
We recommend that you upgrade your drupal6 packages.