Author Topic: Two Code Execution Flaws Patched in Drupal  (Read 727 times)

0 Members and 1 Guest are viewing this topic.

Offline Antus67

  • Full Member
  • ***
  • Posts: 94
    • View Profile
Two Code Execution Flaws Patched in Drupal
« on: January 17, 2019, 01:14:15 PM »
By Eduard Kovacs on January 17, 2019

Updates released on Wednesday for Drupal 7, 8.5 and 8.6 address two potentially serious vulnerabilities that can be exploited for arbitrary code execution.

One of the flaws has been described as a weakness that allows remote execution of arbitrary PHP code. The issue is related to the phar stream wrapper built into PHP and how it handles untrusted phar:// URIs.

“Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability,” Drupal developers explained in an advisory. “This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.”

Full Article Here: