CVE-2008-0273

Publication date 15 January 2008

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Description

Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but are processed as UTF-8 by Internet Explorer, effectively removing characters from the document and defeating the HTML protection mechanism.

Status

Package Ubuntu Release Status
drupal 9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
7.10 gutsy Not in release
7.04 feisty
Fixed 5.1-0ubuntu2.3
6.10 edgy Ignored end of life, was needed
6.06 LTS dapper Ignored end of life
drupal5 9.10 karmic
Not affected
9.04 jaunty
Not affected
8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
7.10 gutsy
Fixed 5.2-2ubuntu2.2
7.04 feisty Not in release
6.10 edgy Not in release
6.06 LTS dapper Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
drupal
drupal5

References

Other references

Access our resources on patching vulnerabilities