Fluid Attacks Database

Description

Drupal arbitrary code execution Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	drupal/core	>=6.0 <6.38	6.38
packagist	drupal/drupal	>=6.0 <6.38	6.38

Aliases

1. CVE-2016-31712. NVD-2016-31713. OSV-2016-31714. GCVE-2016-3171

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3171.yaml2. https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3171.yaml3. https://www.drupal.org/SA-CORE-2016-0014. http://www.debian.org/security/2016/dsa-34985. http://www.openwall.com/lists/oss-security/2016/02/24/196. http://www.openwall.com/lists/oss-security/2016/03/15/10