Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 6 Dec 2013 15:19:18 -0800
From: Forest Monsen <>
To: "" <>
Cc: Kurt Seifried <>
Subject: CVE request for Drupal core, and contributed modules

Hi there, here is a combined request for CVE identifiers for Drupal core,
and contributed modules.

First, core:
SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities

- "Multiple vulnerabilities due to optimistic cross-site request forgery
protection (Form API validation - Drupal 6 and 7)": Correct me if I'm
wrong, but I read this as a single vulnerability in the underlying core
CSRF prevention code; it manifests differently based on the user-created
("contrib") callbacks that employ it.

- "Multiple vulnerabilities due to weakness in pseudorandom number
generation using mt_rand() (Form API, OpenID and random password generation
- Drupal 6 and 7)": Not sure if further classification of this one is

- "Code execution prevention" for the "files" directory .htaccess for
Apache: Execution of local code.

- Access bypass in security token validation (as performed by
drupal_valid_token() ).

- Cross-site scripting in Drupal core's Image module.

- Open redirect in Drupal core's Overlay module.

Now the contributed modules:
SA-CONTRIB-2013-093 - Invitation - Access Bypass

SA-CONTRIB-2013-094 - EU Cookie Compliance - Cross Site Scripting (XSS)

SA-CONTRIB-2013-095 - Organic Groups - Access bypass

SA-CONTRIB-2013-096 - Entity reference - Access bypass

SA-CONTRIB-2013-097 - OG Features - Access bypass



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.