Bug 646660 (CVE-2010-4207, CVE-2010-4208, CVE-2010-4209) - CVE-2010-4207 CVE-2010-4208 CVE-2010-4209 moodle: multiple vulnerabilities in embedded YUI (MSA-10-0017)
Summary: CVE-2010-4207 CVE-2010-4208 CVE-2010-4209 moodle: multiple vulnerabilities i...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-4207, CVE-2010-4208, CVE-2010-4209
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 646661
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-10-25 21:15 UTC by Vincent Danen
Modified: 2019-09-29 12:40 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-11-18 19:56:02 UTC
Embargoed:


Attachments (Terms of Use)

Description Vincent Danen 2010-10-25 21:15:02 UTC
A vulnerability in the YUI 2 Flash component infrastructure allows certain JavaScript injection exploits to be created against domains that host affected YUI .swf files.  The YUI 2.8.2 release corrects this problem [1].  YUI is part of Moodle, and Moodle 1.9.10 includes the fixed YUI .swf files (MSA-10-0017 [2]).

[1] http://yuilibrary.com/support/2.8.2/
[2] http://moodle.org/security/

Comment 1 Vincent Danen 2010-10-25 21:18:39 UTC
Created moodle tracking bugs for this issue

Affects: fedora-all [bug 646661]

Comment 2 Vincent Danen 2010-11-02 17:08:58 UTC
This has been assigned the name CVE-2010-3866.

Comment 3 Vincent Danen 2010-11-08 20:58:15 UTC
CVE-2010-3866 was rejected in favour of CVE-2010-4207, CVE-2010-4208, and CVE-2010-4209 as there are three issues here:

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4207 to
the following vulnerability:

Name: CVE-2010-4207
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4207
Assigned: 20101107
Reference: CONFIRM: http://moodle.org/mod/forum/discuss.php?d=160910
Reference: CONFIRM: http://www.bugzilla.org/security/3.2.8/
Reference: CONFIRM: http://yuilibrary.com/support/2.8.2/
Reference: SECUNIA:41955
Reference: URL: http://secunia.com/advisories/41955
Reference: VUPEN:ADV-2010-2878
Reference: URL: http://www.vupen.com/english/advisories/2010/2878

Cross-site scripting (XSS) vulnerability in the Flash component
infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla,
Moodle, and other products, allows remote attackers to inject
arbitrary web script or HTML via vectors related to
charts/assets/charts.swf.


Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4208 to
the following vulnerability:

Name: CVE-2010-4208
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4208
Assigned: 20101107
Reference: CONFIRM: http://moodle.org/mod/forum/discuss.php?d=160910
Reference: CONFIRM: http://www.bugzilla.org/security/3.2.8/
Reference: CONFIRM: http://yuilibrary.com/support/2.8.2/
Reference: SECUNIA:41955
Reference: URL: http://secunia.com/advisories/41955
Reference: VUPEN:ADV-2010-2878
Reference: URL: http://www.vupen.com/english/advisories/2010/2878

Cross-site scripting (XSS) vulnerability in the Flash component
infrastructure in YUI 2.5.0 through 2.8.1, as used in Bugzilla,
Moodle, and other products, allows remote attackers to inject
arbitrary web script or HTML via vectors related to
uploader/assets/uploader.swf.


Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4209 to
the following vulnerability:

Name: CVE-2010-4209
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4209
Assigned: 20101107
Reference: CONFIRM: http://www.bugzilla.org/security/3.2.8/
Reference: CONFIRM: http://yuilibrary.com/support/2.8.2/
Reference: SECUNIA:41955
Reference: URL: http://secunia.com/advisories/41955
Reference: VUPEN:ADV-2010-2878
Reference: URL: http://www.vupen.com/english/advisories/2010/2878

Cross-site scripting (XSS) vulnerability in the Flash component
infrastructure in YUI 2.8.0 through 2.8.1, as used in Bugzilla 3.7.1
through 3.7.3 and 4.1, allows remote attackers to inject arbitrary web
script or HTML via vectors related to swfstore/swfstore.swf.

Comment 4 Vincent Danen 2011-11-18 19:56:02 UTC
Current Fedora 14/15 have 1.9.14.  Current Fedora 16 has 2.0.5.  Current rawhide and EPEL6 have 2.1.2.


Note You need to log in before you can comment on or make changes to this bug.