[Secure-testing-team] Bug#865498: drupal7: CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users

[Salvatore Bonaccorso]

Source: drupal7
Version: 7.52-2
Severity: normal
Tags: security patch upstream fixed-upstream

Hi,

the following vulnerability was published for drupal7.

CVE-2017-6922[0]:
|Files uploaded by anonymous users into a private file system can be
|accessed by other anonymous users

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-6922
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6922

Please adjust the affected versions in the BTS as needed. Is jessie as
well affected with based version 7.32?

Regards,
Salvatore