Description
Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Drupal.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | drupal | 4.5.3-5 | DSA-958-1 |
Advisories 1
- DSA-958-1 drupal - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2005-2684 vdb-entry
- 220 third-party-advisory
- DSA-958 vendor-advisory
- 18630 third-party-advisory
- 15663 vdb-entry
- 20051201 [DRUPAL-SA-2005-008] Drupal 4.6.4 / 4.5.6 fixes XSS and HTTP header injection issue mailing-list
- 17824 third-party-advisory
- http://drupal.org/files/sa-2005-008/advisory.txt
- http://drupal.org/files/sa-2005-008/4.6.3.patch