View online: https://drupal.org/node/2211381
* Advisory ID: DRUPAL-SA-CONTRIB-2014-027
* Project: NewsFlash [1] (third-party theme)
* Version: 6.x, 7.x
* Date: 2014-March-05
* Security risk: Moderately critical [2]
* Exploitable from: Remote
* Vulnerability: Cross Site Scripting
-------- DESCRIPTION
---------------------------------------------------------
Newsflash is a theme that features 7 color styles, 12 collapsible regions,
suckerfish menus, fluid or fixed widths, built-in IE transparent PNG fix, and
lots more.
The theme does not sanitize the user provided theme setting for the font
family CSS property, thereby exposing a cross-site scripting (XSS)
vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "administer themes".
-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------
* /A CVE identifier [3] will be requested, and added upon issuance, in
accordance with Drupal Security Team processes./
-------- VERSIONS AFFECTED
---------------------------------------------------
* NewsFlash 6.x-1.x versions prior to 6.x-1.7.
* NewsFlash 7.x-1.x versions prior to 7.x-2.5.
Drupal core is not affected. If you do not use the contributed NewsFlash [4]
theme, there is nothing you need to do.
-------- SOLUTION
------------------------------------------------------------
Install the latest version:
* If you use the theme NewsFlash for Drupal 7.x, upgrade to NewsFlash
7.x-2.5 [5]
* If you use the theme NewsFlash for Drupal 6.x, upgrade to NewsFlash
6.x-1.7 [6]
Also see the NewsFlash [7] project page.
-------- REPORTED BY
---------------------------------------------------------
* Dennis Walgaard [8]
-------- FIXED BY
------------------------------------------------------------
* Alyx Vance [9] the theme maintainer
-------- COORDINATED BY
------------------------------------------------------
* Klaus Purer [10] of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION
----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [11].
Learn more about the Drupal Security team and their policies [12], writing
secure code for Drupal [13], and securing your site [14].
Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [15]
[1] http://drupal.org/project/newsflash
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/newsflash
[5] https://drupal.org/node/2210621
[6] https://drupal.org/node/2210619
[7] http://drupal.org/project/newsflash
[8] https://drupal.org/user/883702
[9] https://drupal.org/user/1284976
[10] https://drupal.org/user/262198
[11] http://drupal.org/contact
[12] http://drupal.org/security-team
[13] http://drupal.org/writing-secure-code
[14] http://drupal.org/security/secure-configuration
[15] https://twitter.com/drupalsecurity
_______________________________________________
Security-news mailing list
[email protected]
Unsubscribe at http://lists.drupal.org/mailman/listinfo/security-news
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.