Re: erm patch for D6 I don't think is right
I absolutely hate this. Absolutely hate it. People are freaking out about Drupal 6, when the security team officially supports 7 and 8. I'm seeing all sorts of links to weird pages claiming they have patches for D6. I absolutely hate the idea of sending people to unofficial security fixes. The damage possible is obvious.
I think I've got the patch link right now. Should be this one https://www.drupal.org/node/2955130
Use entirely at your own risk.
C.