--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2009-8184
2009-07-31 17:31:36
--------------------------------------------------------------------------------
Name : drupal-date
Product : Fedora 11
Version : 6.x.2.3
Release : 0.fc11
URL :
http://drupal.org/project/date
Summary : This package contains both the Date module and a Date API module
Description :
The Date API is available to be used by other modules and is not dependent
on having CCK installed. The date module is a flexible date/time field
type for the cck content module which requires the CCK content.module and
the Date API module.
--------------------------------------------------------------------------------
Update Information:
* Advisory ID: DRUPAL-SA-CONTRIB-2009-046 * Project: Date (third-party
module) * Version: 6.x * Date: 2009-July-29 * Security risk: Moderately
critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting
-------- DESCRIPTION ---------------------------------------------------------
The Date module provides a date CCK field that can be added to any content
type. The Date Tools module that is bundled with Date module does not properly
escape user input when displaying labels for fields on a content type. A
malicious user with the 'use date tools' permission of the Date Tools sub-
module, or the 'administer content types' permission could attempt a cross site
scripting [1] (XSS) attack when creating a new content type, leading to the
user gaining full administrative access. -------- VERSIONS AFFECTED
--------------------------------------------------- * Date for Drupal 6.x
prior to 6.x-2.3 Drupal core is not affected. If you do not use the
contributed Date module, there is nothing you need to do. -------- SOLUTION
------------------------------------------------------------ Upgrade to the
latest version: * If you use Date for Drupal 6.x upgrade to Date 6.x-2.3 [2]
Note that the 'use date tools' permission has been renamed as 'administer
date
tools' to clarify that this is an administrative permission (it allows the
creation of new content types via a wizard form). You will need to re-assign
this permission to any roles that were using it. See also the Date project page
[3]. -------- REPORTED BY
--------------------------------------------------------- Stella Power [4] of
the Drupal Security Team -------- FIXED BY
------------------------------------------------------------ Stella Power [5]
and Karen Stevenson [6], the project maintainer. -------- CONTACT
------------------------------------------------------------- The security
contact for Drupal can be reached at security at
drupal.org or via the form at
http://drupal.org/contact. [1]
http://en.wikipedia.org/wiki/Cross-
site_scripting [2]
http://drupal.org/node/534332 [3]
http://drupal.org/project/date [4]
http://drupal.org/user/66894 [5]
http://drupal.org/user/66894 [6]
http://drupal.org/user/45874
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jul 29 2009 Jon Ciesla <limb(a)jcomserv.net> - 6.x.2.3-0
- Update to new version.
- Fix for DRUPAL-SA-CONTRIB-2009-046.
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
6.x.2.0-2.rc4.2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update drupal-date' at the command line.
For more information, refer to "Managing Software with yum",
available at
http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------