CVE-2012-5653

Name	CVE-2012-5653
Description	The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
Source	CVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
References	DSA-2776-1
NVD severity	medium (attack range: remote)
Debian Bugs	696342, 696343
Debian/oldstable	not vulnerable.
Debian/stable	not vulnerable.
Debian/testing	not vulnerable.
Debian/unstable	not vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
drupal6 (PTS)	squeeze (security), squeeze	6.31-1	fixed
drupal7 (PTS)	wheezy, wheezy (security)	7.14-2+deb7u8	fixed
	jessie, sid	7.32-1+deb8u1	fixed

The information above is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
drupal6	source	(unstable)	(unfixed)	medium		696343
drupal6	source	squeeze	6.28-1	medium	DSA-2776-1
drupal7	source	(unstable)	7.14-1.2	medium		696342

http://drupal.org/SA-CORE-2012-004