SB2016072206 - Arch Linux update for drupal
Published: July 22, 2016
Security Bulletin ID
SB2016072206
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Environment variable injection in TYPO3 (CVE-ID: CVE-2016-5385)
The vulnerability allows a remote attacker to redirect an application's outbound HTTP traffic.The vulnerability exists in TYPO3 CMS. A remote attacker can redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.
Successful exploitation of this vulnerability may result in XSS attack and data injection.
Remediation
Install update from vendor's website.