Package: drupal6 Severity: critical Tags: security Justification: root security hole
The Node Block module creates a block from specified content type(s). Node block doesn't properly escape titles allowing users with permissions to create/edit the specified content type(s) to inject arbitrary code into the site. Such a cross site scripting (XSS) attack may lead to a malicious user gaining full administrative access. The above is taken from http://drupal.org/node/683598 Your package is only affected if the Node Block module (from contributed modules) is installed. Please let me know if this module is not present in the drupal6 package. Many regards, Pedro -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (700, 'testing'), (650, 'unstable'), (600, 'experimental'), (500, 'testing-proposed-updates') Architecture: amd64 (x86_64) Kernel: Linux 2.6.33-rc5 (SMP w/2 CPU cores; PREEMPT) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
