GHSA-69g8-g9jq-74v7
Drupal arbitrary code execution
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2016-3171
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · drupal/core | introduced 6.0, fixed 6.38 |
| Packagist · drupal/drupal | introduced 6.0, fixed 6.38 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2016-3171 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3171.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3171.yaml WEB
- https://github.com/drupal/core PACKAGE
- https://www.drupal.org/SA-CORE-2016-001 WEB
- http://www.debian.org/security/2016/dsa-3498 WEB
- http://www.openwall.com/lists/oss-security/2016/02/24/19 WEB
- http://www.openwall.com/lists/oss-security/2016/03/15/10 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |