Advisories ยป MGASA-2013-0356

Updated moodle package fixes security vulnerabilities

Publication date: 30 Nov 2013
Type: security
Affected Mageia releases : 3
CVE: CVE-2013-4522 , CVE-2013-4523 , CVE-2013-4524 , CVE-2013-4525


Some files were being delivered with incorrect headers in Moodle before
2.4.7, meaning they could be cached downstream (CVE-2013-4522).

Cross-site scripting in Moodle before 2.4.7 due to JavaScript in messages
being executed on some pages (CVE-2013-4523).

The file system repository in Moodle before 2.4.7 was allowing access to
files beyond the Moodle file area (CVE-2013-4524).

Cross-site scripting in Moodle before 2.4. due to JavaScript in question
answers being executed on the Quiz Results page (CVE-2013-4525).