That security advisory is about third-party modules made for Drupal 7. If also Drupal 8 were affected, then the advisory would report _Version: 7.x, 8.x_.  
It doesn't report if Drupal 6 is affected, since that is a unsupported version, and the Drupal.org security team doesn't fix security issues on unsupported Drupal versions. Probably, once the involved third-party modules get a security release, it will be possible to see the change done in the code, and if the same security issue is present in the equivalent module for Drupal 6, but that will not be covered from any security advisory done from the security team.

Drupal 7 core is not involved, and I take the security team didn't want to reveal the third-party modules affected to avoid some hackers try to attach Drupal sites. When the security team gives those advisories, there is already a new version available that fixed the security issue; probably, since there are more modules involved, they could not be get a new version for all the modules.

Since the advisory doesn't say which modules are affected, it is not possible to say which version.

That advisory seems more a note to let users know new releases are expected in the next days, and avoid that is missed. They are not still giving a list of modules to update; note the following sentence:

> Release announcements will appear at the [standard announcement locations][1].

The linked page is for releases containing security fixes, and the most recent one was made on July 6, 2016.









  [1]: https://www.drupal.org/security/contrib