Advisories ยป MGASA-2014-0308

Updated moodle package fixes security vulnerabilities

Publication date: 05 Aug 2014
Modification date: 05 Aug 2014
Type: security
Affected Mageia releases : 3 , 4
CVE: CVE-2014-3541 , CVE-2014-3542 , CVE-2014-3543 , CVE-2014-3544 , CVE-2014-3545 , CVE-2014-3546 , CVE-2014-3547 , CVE-2014-3548 , CVE-2014-3551 , CVE-2014-3553

Description

In Moodle before 2.6.4, serialised data passed by repositories could
potentially contain objects defined by add-ons that could include executable
code (CVE-2014-3541).

In Moodle before 2.6.4, it was possible for manipulated XML files passed from
LTI servers to be interpreted by Moodle to allow access to server-side files
(CVE-2014-3542).

In Moodle before 2.6.4, it was possible for manipulated XML files to be
uploaded to the IMSCC course format or the IMSCP resource to allow access to
server-side files (CVE-2014-3543).

In Moodle before 2.6.4, filtering of the Skype profile field was not removing
potentially harmful code (CVE-2014-3544).

In Moodle before 2.6.4, it was possible to inject code into Calculated
questions that would be executed on the server (CVE-2014-3545).

In Moodle before 2.6.4, it was possible to get limited user information,
such as user name and courses, by manipulating the URL of profile and notes
pages (CVE-2014-3546).

In Moodle before 2.6.4, the details of badges from external sources were not
being filtered (CVE-2014-3547).

In Moodle before 2.6.4, content of exception dialogues presented from AJAX
calls was not being escaped before being presented to users (CVE-2014-3548).

In Moodle before 2.6.4, fields in rubrics were not being correctly filtered
(CVE-2014-3551).

In Moodle before 2.6.4, forum was allowing users who were members of more
than one group to post to all groups without the capability to access all
groups (CVE-2014-3553).

The moodle package has been updated to version 2.6.4, to fix these issues
and other bugs.

References

SRPMS

3/core

4/core