GHSA-69g8-g9jq-74v7high8.1
Drupal arbitrary code execution
Impact
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/core Packagist
| Affected range | Recorded fix |
|---|---|
| From 6.0 before 6.38Ecosystem versions | 6.38 |
Version evidence: OSV · GHSA-69g8-g9jq-74v7
View original version evidence (0 explicit versions)
drupal/drupal Packagist
| Affected range | Recorded fix |
|---|---|
| From 6.0 before 6.38Ecosystem versions | 6.38 |
Version evidence: OSV · GHSA-69g8-g9jq-74v7
View original version evidence (0 explicit versions)
Original source description
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2016-3171
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3171.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3171.yaml
- Source reference github.com/drupal/core
- Security advisory www.drupal.org/SA-CORE-2016-001
- Security advisory www.debian.org/security/2016/dsa-3498
- Security advisory www.openwall.com/lists/oss-security/2016/02/24/19
- Security advisory www.openwall.com/lists/oss-security/2016/03/15/10