Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 16 Aug 2014 03:43:18 -0400 (EDT)
Subject: Re: CVE request for Drupal core, and contributed modules

Hash: SHA1

> SA-CORE-2014-004 - Drupal core - Denial of service

[ as mentioned in the post, "It was
fixed by Michael Adams and Andrew Nacin of the WordPress security team
and David Rothstein of the Drupal security team ... the code was the
same and our patches differed only in coding standards" ]


Use CVE-2014-5265 for the code changes in (Drupal) and
class-IXR.php (WordPress) to prevent entity declarations and therefore
address the "vulnerable to an XML entity expansion attack ... can
cause CPU and memory exhaustion" concern.


Use CVE-2014-5266 for the "Skip parsing if there is an unreasonably
large number of tags" in both and (Drupal) and the
"Bail if there are too many elements to parse" in class-IXR.php


Use CVE-2014-5267 for the code change to reject any XRDS document with
a /<!DOCTYPE/i match. (This is not really identical to CVE-2014-5265,
although part of the goal is the same.)

> And the appropriate number for the following Drupal contributed modules:

> SA-CONTRIB-2014-075 - Biblio Autocomplete - SQL Injection and Access Bypass

> SQL Injection

Use CVE-2014-5249. See

> Additionally, the AJAX autocompletion callback itself was not properly
> secured, thus potentially allowing any visitor access to the data,
> including the anonymous user.

Use CVE-2014-5250. See

> SA-CONTRIB-2014-076 - Fasttoggle - Access bypass

Use CVE-2014-5268. We think this means that, in the vulnerable
version, an unauthorized person could change an arbitrary user account
from "allow" status to "block" status, or change an arbitrary user
account from "block" status to "allow" status.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.