Debian: DSA-1792-1 Moderate: Drupal Cross-Site Scripting Attack

pod.Edge discovered a cross-site scripting vulnerability due that can be
triggered when some browsers interpret UTF-8 strings as UTF-7 if they
appear before the generated HTML document defines its Content-Type.
This allows a malicious user to execute arbitrary javascript in the
context of the web site if they're allowed to post content.

Moritz Naumann discovered an information disclosure vulnerability. If
a user is tricked into visiting the site via a specially crafted URL
and then submits a form (such as the search box) from that page, the
information in their form submission may be directed to a third-party
site determined by the URL and thus disclosed to the third party. The
third party site may then execute a cross-site request forgery attack
against the submitted form.

For the stable distribution (lenny), these problems have been fixed in version
6.6-3lenny1.

The old stable distribution (etch) does not contain drupal and is not
affected.

For the unstable distribution (sid), these problems hav...