=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2008/VULN286
_____________________________________________________________________

DATE                      : 10/07/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Drupal versions 6.x and 5.x
                                prior to 6.3 and 5.8.

======================================================================
http://drupal.org/drupal-6.3
______________________________________________________________________

Drupal 6.3 and 5.8 released, fixing security issues
News and announcements · Drupal 6.x
Gábor Hojtsy - July 9, 2008 - 23:12
Download Drupal 6.3
Download Drupal 5.8

Drupal 6.3 and Drupal 5.8, maintenance releases fixing problems reported
using the bug tracking system, as well as security vulnerabilities, are
now available for download. Drupal 6.3 also includes some changes to the
installer to prevent file ownership issues on shared hosts; upgrades
jQuery to version 1.2.6; improves PostreSQL compatibility; fixes
performance issues in search, menu and form API and contains a variety
of other small improvements. It should also be noted that the Views for
Drupal 6 release candidate requires Drupal 6.3 to run properly.

Upgrading your existing Drupal 5 and 6 sites is strongly recommended.
There are no new features in these releases, but we fixed some notable
performance issues too. For more information about the Drupal 6.x
release series, consult the Drupal 6.0 release announcement, more
information on the 5.x releases can be found in Drupal 5.0 release
announcement.


Security information


We have a security announcement mailing list, a history of all security
advisories, and an RSS feed with the most recent security advisories. We
strongly advise Drupal administrators to sign up for the list.

Drupal 6 also includes the Update status module built-in, which informs
you about important updates to your modules and themes.


Bug reports

Both Drupal 5.x and 6.x branches are being maintained, so given enough
bug fixes (not just bug reports) more maintenance releases will be made
available.


Changelog

The full list of changes between the 6.2 and 6.3 releases can be found
by reading the 6.3 release notes. A complete list of all bug fixes in
the stable DRUPAL-6 branch can be found at
http://drupal.org/project/cvs/3060/?branch=DRUPAL-6.

The full list of changes between the 5.7 and 5.8 releases can be found
by reading the 5.8 release notes. A complete list of all bug fixes in
the stable DRUPAL-5 branch can be found at
http://drupal.org/project/cvs/3060/?branch=DRUPAL-5.


Security vulnerabilities

Drupal 6.3 and 5.8 were released in response to the discovery of
security vulnerabilities. Details can be found in the official security
advisory:

     * SA-2008-044

To fix the security problems, you can either (1) upgrade Drupal or (2)
patch Drupal.

We recommend you do the full upgrade (which is also detailed in the
security announcement) as the patches do not contain the additional
bugfixes that went into the release. Applying the patches will leave
your site in an unversioned state and confuse update status module,
which will keep reminding you to upgrade to 6.3 or 5.8. Please read the
announcement for details on the patches.

If you still prefer to patch Drupal, apply the
http://drupal.org/files/sa-2008-044/SA-2008-044-6.2.patch file to your
Drupal 6.2 code base or
http://drupal.org/files/sa-2008-044/SA-2008-044-5.7.patch to your Drupal
  5.7 codebase.

Important update notes

Although these releases contain no database changes, it is important to
run update.php to refresh the menu cache and other caches on the
website.


======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================