GHSA-69g8-g9jq-74v7
Drupal arbitrary code execution
At a glance
- Published
- Updated
- CVE
- CVE-2016-3171
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
Affected packages
| Package | Versions |
|---|---|
| Packagist · drupal/core | introduced 6.0, fixed 6.38 |
| Packagist · drupal/drupal | introduced 6.0, fixed 6.38 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3171 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3171.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3171.yaml WEB
- https://github.com/drupal/core PACKAGE
- https://www.drupal.org/SA-CORE-2016-001 WEB
- http://www.debian.org/security/2016/dsa-3498 WEB
- http://www.openwall.com/lists/oss-security/2016/02/24/19 WEB
- http://www.openwall.com/lists/oss-security/2016/03/15/10 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |