CVE-2016-3171
high
CVSS v3
8.1
CVSS v2
6.8
VIR risk
8.1
Description
Drupal arbitrary code execution
Predictions
Exploit likelihood
88%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — https://www.drupal.org/SA-CORE-2016-001
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | 7.0 | affected | |
| debian | 8.0 | affected | |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | drupal/core | >=6.0,<6.38 | 6.38 |
| Packagist | drupal/drupal | >=6.0,<6.38 | 6.38 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| php | php | {"endIncluding":"5.4.44"} | |
| php | php | 5.5.0 | |
| php | php | 5.5.1 | |
| php | php | 5.5.2 | |
| php | php | 5.5.10 | |
| php | php | 5.5.11 | |
| php | php | 5.5.12 | |
| php | php | 5.5.13 | |
| php | php | 5.5.14 | |
| php | php | 5.5.18 | |
| php | php | 5.5.19 | |
| php | php | 5.5.20 | |
| php | php | 5.5.21 | |
| php | php | 5.5.22 | |
| php | php | 5.5.23 | |
| php | php | 5.5.24 | |
| php | php | 5.5.25 | |
| php | php | 5.5.26 | |
| php | php | 5.5.27 | |
| php | php | 5.5.28 | |
| php | php | 5.6.0 | |
| php | php | 5.6.1 | |
| php | php | 5.6.2 | |
| php | php | 5.6.3 | |
| php | php | 5.6.4 | |
| php | php | 5.6.5 | |
| php | php | 5.6.6 | |
| php | php | 5.6.7 | |
| php | php | 5.6.8 | |
| php | php | 5.6.9 | |
| php | php | 5.6.10 | |
| php | php | 5.6.11 | |
| php | php | 5.6.12 | |
| drupal | drupal | 6.0 | |
| drupal | drupal | 6.1 | |
| drupal | drupal | 6.2 | |
| drupal | drupal | 6.3 | |
| drupal | drupal | 6.4 | |
| drupal | drupal | 6.5 | |
| drupal | drupal | 6.6 | |
| drupal | drupal | 6.7 | |
| drupal | drupal | 6.8 | |
| drupal | drupal | 6.9 | |
| drupal | drupal | 6.10 | |
| drupal | drupal | 6.11 | |
| drupal | drupal | 6.12 | |
| drupal | drupal | 6.13 | |
| drupal | drupal | 6.14 | |
| drupal | drupal | 6.15 | |
| drupal | drupal | 6.16 | |
| drupal | drupal | 6.17 | |
| drupal | drupal | 6.18 | |
| drupal | drupal | 6.19 | |
| drupal | drupal | 6.20 | |
| drupal | drupal | 6.21 | |
| drupal | drupal | 6.22 | |
| drupal | drupal | 6.23 | |
| drupal | drupal | 6.24 | |
| drupal | drupal | 6.25 | |
| drupal | drupal | 6.26 | |
| drupal | drupal | 6.27 | |
| drupal | drupal | 6.28 | |
| drupal | drupal | 6.29 | |
| drupal | drupal | 6.30 | |
| drupal | drupal | 6.31 | |
| drupal | drupal | 6.32 | |
| drupal | drupal | 6.33 | |
| drupal | drupal | 6.34 | |
| drupal | drupal | 6.35 | |
| drupal | drupal | 6.36 | |
| drupal | drupal | 6.37 | |
References
- http://www.debian.org/security/2016/dsa-3498
- http://www.openwall.com/lists/oss-security/2016/02/24/19
- http://www.openwall.com/lists/oss-security/2016/03/15/10
- https://www.drupal.org/SA-CORE-2016-001
- https://nvd.nist.gov/vuln/detail/CVE-2016-3171
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3171.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3171.yaml
- https://github.com/drupal/core
CWEs
CWE-19
Verify integrity in audit chain (admin only). AS-IS.