Drupal 6.15 - Security patches released

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

I'll take this one. Will be done after final close bug 431080.
Note: 6.15 version is current available in lucid, so bug is affecting jaunty and karmic releases. Should be tasked.

No longer drupal5 in lucid.

drupal6 (6.15-1) unstable; urgency=low

  * New upstream release (Closes: #561726)
    - Fixes several XSS vulnerabilities (Closes: #562165)
      (Ref: SA-CORE-2009-009, CVE-2009-4369, CVE-2009-4370, CVE-2009-4371)

  * debian/rules
    - Use dh_prep instead of dh_clean -k

  * debian/control
    - Upgraded versioned dependency on debhelper to 7

  * debian/README.source
    - Added directions on source handling
 -- Ubuntu Archive Auto-Sync < <email address hidden>> Mon, 18 Jan 2010 07:30:21 +0000

Is a fix still planned for jaunty? It's been a week since the fix for lucid was released, if not I can create my own. However if you are planning on a release, then I don't need to :)

Of course, I'm going to fix issue in jaunty and karmic both for drupal5 and drupal6, so you don't need spend time on this. At the latest patch will be uploaded @ next week.

Thanks for the debdiffs Artur, the updated packages have been uploaded.

Next time, could you please use the updated patch tagging guidelines, as we've now switched to Debian's format:

http://dep.debian.net/deps/dep3/

This bug was fixed in the package drupal6 - 6.12-1.1ubuntu1.1

---------------
drupal6 (6.12-1.1ubuntu1.1) karmic-security; urgency=low

  * debian/patches/22_SA-CORE-2009-009.dpatch:
    - SECURITY UPDATE due to multiple vulnerabilities
      and weaknesses were discovered in Drupal (LP: #510421)
    - CVE-2009-4369
    - CVE-2009-4370
    - CVE-2009-4371
 -- Artur Rona <email address hidden> Mon, 22 Feb 2010 00:13:26 +0100

This bug was fixed in the package drupal5 - 5.18-1.1ubuntu2.1

---------------
drupal5 (5.18-1.1ubuntu2.1) karmic-security; urgency=low

  * debian/patches/22_SA-CORE-2009-009.dpatch:
    - SECURITY UPDATE due to multiple vulnerabilities
      and weaknesses were discovered in Drupal (LP: #510421)
    - CVE-2009-4369
    - CVE-2009-4370
    - CVE-2009-4371
 -- Artur Rona <email address hidden> Mon, 22 Feb 2010 00:11:25 +0100

This bug was fixed in the package drupal6 - 6.10-1ubuntu0.2

---------------
drupal6 (6.10-1ubuntu0.2) jaunty-security; urgency=low

  * debian/patches/22_SA-CORE-2009-009.dpatch:
    - SECURITY UPDATE due to multiple vulnerabilities
      and weaknesses were discovered in Drupal (LP: #510421)
    - CVE-2009-4369
    - CVE-2009-4370
    - CVE-2009-4371
 -- Artur Rona <email address hidden> Mon, 22 Feb 2010 00:12:33 +0100

This bug was fixed in the package drupal5 - 5.15-1ubuntu1.2

---------------
drupal5 (5.15-1ubuntu1.2) jaunty-security; urgency=low

  * debian/patches/22_SA-CORE-2009-009.dpatch:
    - SECURITY UPDATE due to multiple vulnerabilities
      and weaknesses were discovered in Drupal (LP: #510421)
    - CVE-2009-4369
    - CVE-2009-4370
    - CVE-2009-4371
 -- Artur Rona <email address hidden> Sun, 21 Feb 2010 22:00:32 +0100