CVE-2012-5653

Name	CVE-2012-5653
Description	The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
References	DSA-2776-1
NVD severity	medium (attack range: remote)
Debian Bugs	696342, 696343

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
drupal7 (PTS)	wheezy	7.14-2+deb7u12	fixed
	wheezy (security)	7.14-2+deb7u16	fixed
	jessie, jessie (security)	7.32-1+deb8u9	fixed
	stretch, stretch (security)	7.52-2+deb9u1	fixed
	buster, sid	7.56-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
drupal6	source	(unstable)	(unfixed)	medium		696343
drupal6	source	squeeze	6.28-1	medium	DSA-2776-1
drupal7	source	(unstable)	7.14-1.2	medium		696342

http://drupal.org/SA-CORE-2012-004