FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-1575

This CVE name corresponds to:

Entered	Topic
2009-04-30	drupal -- cross site scripting

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-1575 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-1575
Phase	Assigned(20090506)

Description

Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows remote attackers to inject arbitrary web script or HTML via crafted UTF-8 byte sequences before the Content-Type meta tag, which are treated as UTF-7 by Internet Explorer 6 and 7.

References

Source	Reference
CONFIRM	http://drupal.org/node/449078
CONFIRM	http://www.vbdrupal.org/forum/showthread.php?p=9953#post9953
DEBIAN	DSA-1792
FEDORA	FEDORA-2009-4175
FEDORA	FEDORA-2009-4203
OSVDB	54152
SECUNIA	34948
SECUNIA	34950
SECUNIA	34980
VUPEN	ADV-2009-1216
XF	drupal-utf7-xss(50250)