Bug 809223 (CVE-2012-1155, CVE-2012-1156, CVE-2012-1157, CVE-2012-1158, CVE-2012-1159, CVE-2012-1160, CVE-2012-1161, CVE-2012-1168, CVE-2012-1169, CVE-2012-1170) - CVE-2012-1155 CVE-2012-1156 CVE-2012-1157 CVE-2012-1158 CVE-2012-1159 CVE-2012-1160 CVE-2012-1161 CVE-2012-1168 CVE-2012-1169 CVE-2012-1170 moodle: multiple security fixes in 2.2.2, 2.1.5, 2.0.8, 1.9.17
Summary: CVE-2012-1155 CVE-2012-1156 CVE-2012-1157 CVE-2012-1158 CVE-2012-1159 CVE-201...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-1155, CVE-2012-1156, CVE-2012-1157, CVE-2012-1158, CVE-2012-1159, CVE-2012-1160, CVE-2012-1161, CVE-2012-1168, CVE-2012-1169, CVE-2012-1170
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 809226 809227
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-02 19:06 UTC by Vincent Danen
Modified: 2019-09-29 12:51 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-05-28 16:53:11 UTC
Embargoed:


Attachments (Terms of Use)

Description Vincent Danen 2012-04-02 19:06:46 UTC
A number of flaws have been fixed in new upstream Moodle 2.2.2 [1], 2.1.5
[2], 2.0.8 [3], and 1.9.17 [4] releases.  These do not have CVEs assigned
(request pending), and since Fedora/EPEL will rebase to the latest versions
of each branch, I'm summarizing them all here rather than creating a number
of separate bugs.

[1] http://docs.moodle.org/dev/Moodle_2.2.2_release_notes
[2] http://docs.moodle.org/dev/Moodle_2.1.5_release_notes
[3] http://docs.moodle.org/dev/Moodle_2.0.8_release_notes
[4] http://docs.moodle.org/dev/Moodle_1.9.17_release_notes

MSA-12-0013: Database activity export permission issue (CVE-2012-1155)
Affects: 2.2.x, 2.1.x, 2.0.x, 1.9.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-25185
Reference: http://moodle.org/mod/forum/discuss.php?d=198621

MSA-12-0014: Password and Web services issue (CVE-2012-1168)
Affects: 2.2.x, 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-30878
Reference: http://moodle.org/mod/forum/discuss.php?d=198622

MSA-12-0015: Backup and private files issue (CVE-2012-1156)
Affects: 2.2.x, 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29248
Reference: http://moodle.org/mod/forum/discuss.php?d=198623

MSA-12-0016: Default repository capabilities issue (CVE-2012-1157)
Affects: 2.2.x, 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git;a=commit;h=246c2cb8e5af71a7d7c605b8fc9f9563e0fb3bc4
Reference: http://moodle.org/mod/forum/discuss.php?d=198624

MSA-12-0017: Personal information leak issue (CVE-2012-1169)
Affects: 2.2.x, 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31463
Reference: http://moodle.org/mod/forum/discuss.php?d=198625

MSA-12-0018: Course information leak in Gradebook export (CVE-2012-1158)
Affects: 2.2.x, 2.1.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29080
Reference: http://moodle.org/mod/forum/discuss.php?d=198627

MSA-12-0019: Overview report and hidden course issue (CVE-2012-1159)
Affects: 2.2.x, 2.1.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29892
Reference: http://moodle.org/mod/forum/discuss.php?d=198628

MSA-12-0020: Forum subscription permission issue (CVE-2012-1160)
Affects: 2.2.x, 2.1.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31426
Reference: http://moodle.org/mod/forum/discuss.php?d=198629

MSA-12-0021: Course information leak through tags (CVE-2012-1161)
Affects: 2.2.x, 2.1.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31466
Reference: http://moodle.org/mod/forum/discuss.php?d=198630

MSA-12-0022: Security conflict in Web services
Affects: 2.2.x, 2.1.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-30495
Reference: http://moodle.org/mod/forum/discuss.php?d=198631

MSA-12-0023: External enrolment plugin context check issue (CVE-2012-1170)
Affects: 2.2.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31178
Reference: http://moodle.org/mod/forum/discuss.php?d=198632

Comment 1 Vincent Danen 2012-04-02 19:11:15 UTC
Created moodle tracking bugs for this issue

Affects: fedora-all [bug 809226]
Affects: epel-all [bug 809227]

Comment 2 Vincent Danen 2012-04-12 21:30:32 UTC
moodle-2.2.2-1.fc17 has been pushed to the Fedora 17 stable repository.

moodle-2.0.8-1.fc16 has been pushed to the Fedora 16 stable repository.

moodle-1.9.17-1.fc15 has been pushed to the Fedora 15 stable repository.


Note You need to log in before you can comment on or make changes to this bug.