Skip to content
OpenAdvisories
Critical DSA-4370-1 2 CVEs

drupal7 - security update

Published Jan 17, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 drupal7 7.52-2+deb9u6

Vulnerabilities 2

  • Critical 9.8
    CVE-2019-6339 Public exploit EPSS 36%

    PHAR stream wrapper Arbitrary PHP code execution

    In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, c…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • High 8.0
    CVE-2019-6338

    third-party PEAR Archive_Tar library updates

    In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-100088…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist