diff options
| author | Simon L. B. Nielsen <simon@FreeBSD.org> | 2006-06-05 19:48:00 +0000 |
|---|---|---|
| committer | Simon L. B. Nielsen <simon@FreeBSD.org> | 2006-06-05 19:48:00 +0000 |
| commit | f6daabd82ba120828784ed66b10dbbc5c94a51d6 (patch) | |
| tree | 3f33f4f97a069e1625ec5284832bf53032e6155a | |
| parent | Update to 2.3.0 (diff) | |
Document drupal -- multiple vulnerabilities.
Notes
Notes:
svn path=/head/; revision=164490
| -rw-r--r-- | security/vuxml/vuln.xml | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index fa0d57e40ad9..fba1aac3cea8 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,45 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="40a0185f-ec32-11da-be02-000c6ec775d9"> + <topic>drupal -- multiple vulnerabilities</topic> + <affects> + <package> + <name>drupal</name> + <range><lt>4.6.7</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The Drupal team reports:</p> + <blockquote cite="http://drupal.org/node/65357"> + <p>Vulnerability: SQL injection</p> + <p>A security vulnerability in the database layer allowed + certain queries to be submitted to the database without + going through Drupal's query sanitizer.</p> + </blockquote> + <blockquote cite="http://drupal.org/node/65409"> + <p>Vulnerability: Execution of arbitrary files</p> + <p>Certain -- alas, typical -- configurations of Apache + allows execution of carefully named arbitrary scripts in + the files directory. Drupal now will attempt to + automatically create a .htaccess file in your "files" + directory to protect you.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2006-2742</cvename> + <cvename>CVE-2006-2743</cvename> + <url>http://drupal.org/node/65357</url> + <url>http://drupal.org/node/65409</url> + </references> + <dates> + <discovery>2006-05-18</discovery> + <entry>2006-06-05</entry> + </dates> + </vuln> + <vuln vid="7f8cecea-f199-11da-8422-00123ffe8333"> <topic>MySQL -- SQL-injection security vulnerability</topic> <affects> |