30 April 2009, 11:51

Security Update for Drupal

The developers of the Drupal content management system have released version 5.17 and 6.11 to close a cross site scripting vulnerability. The vulnerability can only be exploited if a browser interprets valid UTF8 byte sequences as UTF7. When this occurs they can become potentially dangerous. According to the report, this can include Internet Explorer 6 and in certain cases 7.

The new version also fixed a bug which allowed abuse through Cross-Site Request forgery. There are update patches available for the problems and the developers have published several advisories on vulnerabilities in extension modules from third parties.

See also: