{
  "schema_version": "1.7.0",
  "id": "MGASA-2015-0110",
  "published": "2015-03-18T23:01:47Z",
  "modified": "2015-03-18T22:53:42Z",
  "summary": "Updated moodle packages fix security vulnerabilities",
  "details": "Updated moodle package fixes security vulnerabilities:\n\nIn Moodle before 2.6.9, by modifying URL a logged in user can view the list\nof another user's contacts, number of unread messages and list of their\ncourses (CVE-2015-2266).\n\nIn Moodle before 2.6.9, authentication in mdeploy can be bypassed. It is\ntheoretically possible to extract files anywhere on the system where the web\nserver has write access. The attacking user must know details about the\nsystem and already have significant permissions on the site (CVE-2015-2267).\n\nIn Moodle before 2.6.9, a non-optimal regular expression in the \"Convert\nlinks to URLs\" filter could be exploited to create extra server load or make\nparticular pages unavailable (CVE-2015-2268).\n\nIn Moodle before 2.6.9, it is possible to create HTML injection through\nblocks with configurable titles, however this could only be exploited by\nusers who are already marked as XSS-trusted (CVE-2015-2269).\n\nIn Moodle before 2.6.9, for the custom themes that use blocks regions in the\nbase layout the blocks for inaccessible courses could be displayed together\nwith sensitive course-related information. Most of the themes, including all\nstandard Moodle themes, are not affected (CVE-2015-2270).\n\nIn Moodle before 2.6.9, users without proper permission are able to mark\ntags as inappropriate. Since this capability is given to authenticated users\nby default, this is not an issue for most sites (CVE-2015-2271).\n\nIn Moodle before 2.6.9, even when user's password is forced to be changed on\nlogin, user could still use it for authentication in order to create the web\nservice token and therefore extend the life of the temporary password via\nweb services (CVE-2015-2272).\n\nIn Moodle before 2.6.9, Quiz statistics report did not properly escape\nstudent responses and could be used for XSS attack (CVE-2015-2273).\n",
  "upstream": [
    "CVE-2015-2266",
    "CVE-2015-2267",
    "CVE-2015-2268",
    "CVE-2015-2269",
    "CVE-2015-2270",
    "CVE-2015-2271",
    "CVE-2015-2272",
    "CVE-2015-2273"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2015-0110.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=15501"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=307380"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=307381"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=307382"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=307383"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=307384"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=307385"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=307386"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=307387"
    },
    {
      "type": "WEB",
      "url": "https://docs.moodle.org/dev/Moodle_2.6.10_release_notes"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=305077"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:4",
        "name": "moodle",
        "purl": "pkg:rpm/mageia/moodle?arch=source&distro=mageia-4"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.10-1.mga4"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}