CVE-2015-3234

NameCVE-2015-3234
DescriptionThe OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-3291-1

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
drupal6sourcesqueeze(unfixed)end-of-life
drupal6source(unstable)(unfixed)
drupal7sourcewheezy7.14-2+deb7u10DSA-3291-1
drupal7sourcejessie7.32-1+deb8u4DSA-3291-1
drupal7source(unstable)7.38-1

Notes

https://www.drupal.org/SA-CORE-2015-002

Search for package or bug name: Reporting problems