Updated Drupal7 packages has been released for Debian GNU/Linux 7 LTS

Package : drupal7
Version : 7.14-2+deb7u16
CVE ID : CVE-2017-6922

Private files that have been uploaded by an anonymous user but not permanently
attached to content on the site should only be visible to the anonymous user
that uploaded them, rather than all anonymous users. Drupal core did not
previously provide this protection, allowing an access bypass vulnerability to
occur. This issue is mitigated by the fact that in order to be affected, the
site must allow anonymous users to upload files into a private file system.

For Debian 7 "Wheezy", these problems have been fixed in version
7.14-2+deb7u16.

We recommend that you upgrade your drupal7 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

  Drupal7 security update for Debian 7 LTS