[drupal7] CVE-2014-3704 - Drupal - pre Auth SQL Injection Vulnerability

Debian Bug report logs - #765507
[drupal7] CVE-2014-3704 - Drupal - pre Auth SQL Injection Vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Ingo Juergensmann <ij@2013.bluespice.org>

To: submit@bugs.debian.org

Subject: [drupal7] CVE-2014-3704 - Drupal - pre Auth SQL Injection Vulnerability

Date: Wed, 15 Oct 2014 19:06:34 +0200

Package: drupal7
Version: 7.31-1
Severity: normal
Tags: security
X-Debbugs-CC: secure-testing-team@lists.alioth.debian.org

--- Please enter the report below this line. ---

Hi!

There's a security issue in all Drupal7 version <7.32. See:
- https://www.drupal.org/drupal-7.32-release-notes
- 
https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html

Please provide a new and fixed package. Thanks!


--- System information. ---
Architecture: amd64
Kernel:       Linux 3.16-2-amd64

Debian Release: jessie/sid
  500 unstable        www.deb-multimedia.org
  500 unstable        ftp.de.debian.org

--- Package information. ---
Depends                    (Version) | Installed
====================================-+-============
debconf                    (>= 0.5)  | 1.5.53
 OR debconf-2.0                      |
apache2                              | 2.4.10-5
 OR httpd                            |
php5                                 | 5.6.0+dfsg-1
php5-mysql                           | 5.6.0+dfsg-1+b1
 OR php5-pgsql                       | 5.6.0+dfsg-1+b1
 OR php5-sqlite                      | 5.6.0+dfsg-1+b1
php5-gd                              | 5.6.0+dfsg-1+b1
default-mta                          |
 OR mail-transport-agent             |
wwwconfig-common         (>= 0.0.37) | 0.2.2
mysql-client                         | 5.5.39-1
 OR virtual-mysql-client             |
 OR postgresql-client                | 9.4+162
dbconfig-common                      | 1.8.47+nmu1
curl                                 | 7.38.0-2


Recommends        (Version) | Installed
===========================-+-===========
mysql-server                | 5.5.39-1
 OR postgresql              | 9.4+162
 OR sqlite3                 | 3.8.6-1


Package's Suggests field is empty.




-- 
Ciao...            //      Fon: 0381-2744150
      Ingo       \X/       http://blog.windfluechter.net
Please don't share this address with Facebook or Google!
gpg pubkey: http://www.juergensmann.de/ij_public_key.asc

Message #10 received at 765507-done@bugs.debian.org (full text, mbox, reply):

From: Gunnar Wolf <gwolf@gwolf.org>

To: 765507-done@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: [drupal7] CVE-2014-3704 - Drupal - pre Auth SQL Injection Vulnerability

Date: Fri, 17 Oct 2014 10:50:21 -0500

notfound 765507 7.32-1~bpo70+1
notfound 765507 7.32-1
notfound 765507 7.14-2+deb7u7
notfound 765507 7.14-2+deb7u6~bpo60+1
thanks

Version: 7.32-1

The fixed package was uploaded concurrently with this bug's
filing. Closing it by hand :)

Message #29 received at 765507-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 765507-submitter@bugs.debian.org

Subject: closing 765507

Date: Fri, 17 Oct 2014 18:16:04 +0200

close 765507 7.32-1
thanks

Sorry for the reopen, tried to mark it with the fixed control command (vs.
notfound) to get the version tracking information right.

Send a report that this bug log contains spam.