Category Archives: Security

Security

Security

Ubuntu Security Notice USN-2319-3

Ubuntu Security Notice 2319-3 – USN-2319-1 fixed vulnerabilities in OpenJDK 7. This update provides stability fixes for the arm64 and ppc64el architectures. Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. Various other issues were also addressed.

Security

Red Hat Security Advisory 2014-1255-01

Red Hat Security Advisory 2014-1255-01 – Kerberos is an authentication system which allows clients and services to authenticate to each other with the help of a trusted third party, a Kerberos Key Distribution Center. A buffer overflow was found in the KADM5 administration server when it was used with an LDAP back end for the KDC database. A remote, authenticated attacker could potentially use this flaw to execute arbitrary code on the system running kadmind. All krb5 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the krb5kdc and kadmind daemons will be restarted automatically.

Security

Debian Security Advisory 3025-1

Debian Linux Security Advisory 3025-1 – It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data (CVE-2014-0488), performs incorrect verification of 304 replies (CVE-2014-0487), does not perform the checksum check when the Acquire::GzipIndexes option is used (CVE-2014-0489) and does not properly perform validation for binary packages downloaded by the apt-get download command (CVE-2014-0490).

Drupal

SA-CONTRIB-2014-091 – Survey Builder – Cross Site Scripting (XSS)

Description

This module allows you to use the Form Builder module to provide an intuitive interface for building surveys, along with the back-end for storing surveys and their responses.

Cross Site Scripting (XSS)

When viewing surveys at “/surveys”, the survey titles printed out are not sanitized. Any potentially dangerous code in the survey titles is also rendered.

This vulnerability is mitigated by the fact that a user must have the “Create Survey” permission to be able to set the survey titles.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • survey_builder 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Survey Builder module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Survey Builder project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: 
Drupal 7.x