CVE

Id
15179  
CVE No.
CVE-2005-3975  
Status
Candidate  
Description
Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Drupal.  
Phase
Assigned (20051203)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
118568 15179 CVE-2005-3975 BUGTRAQ:20051201 [DRUPAL-SA-2005-008] Drupal 4.6.4 / 4.5.6 fixes XSS and HTTP header injection issue  View
118569 15179 CVE-2005-3975 URL:http://www.securityfocus.com/archive/1/archive/1/418291/100/0/threaded  View
118570 15179 CVE-2005-3975 MISC:http://drupal.org/files/sa-2005-008/4.6.3.patch  View
118571 15179 CVE-2005-3975 CONFIRM:http://drupal.org/files/sa-2005-008/advisory.txt  View
118572 15179 CVE-2005-3975 DEBIAN:DSA-958  View
118573 15179 CVE-2005-3975 URL:http://www.debian.org/security/2006/dsa-958  View
118574 15179 CVE-2005-3975 BID:15663  View
118575 15179 CVE-2005-3975 URL:http://www.securityfocus.com/bid/15663  View
118576 15179 CVE-2005-3975 VUPEN:ADV-2005-2684  View
118577 15179 CVE-2005-3975 URL:http://www.vupen.com/english/advisories/2005/2684  View
118578 15179 CVE-2005-3975 SECUNIA:17824  View
118579 15179 CVE-2005-3975 URL:http://secunia.com/advisories/17824  View
118580 15179 CVE-2005-3975 SECUNIA:18630  View
118581 15179 CVE-2005-3975 URL:http://secunia.com/advisories/18630  View
118582 15179 CVE-2005-3975 SREASON:220  View

Related JVN