A number of flaws have been fixed in new upstream Moodle 2.2.2 [1], 2.1.5 [2], 2.0.8 [3], and 1.9.17 [4] releases. These do not have CVEs assigned (request pending), and since Fedora/EPEL will rebase to the latest versions of each branch, I'm summarizing them all here rather than creating a number of separate bugs. [1] http://docs.moodle.org/dev/Moodle_2.2.2_release_notes [2] http://docs.moodle.org/dev/Moodle_2.1.5_release_notes [3] http://docs.moodle.org/dev/Moodle_2.0.8_release_notes [4] http://docs.moodle.org/dev/Moodle_1.9.17_release_notes MSA-12-0013: Database activity export permission issue (CVE-2012-1155) Affects: 2.2.x, 2.1.x, 2.0.x, 1.9.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-25185 Reference: http://moodle.org/mod/forum/discuss.php?d=198621 MSA-12-0014: Password and Web services issue (CVE-2012-1168) Affects: 2.2.x, 2.1.x, 2.0.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-30878 Reference: http://moodle.org/mod/forum/discuss.php?d=198622 MSA-12-0015: Backup and private files issue (CVE-2012-1156) Affects: 2.2.x, 2.1.x, 2.0.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29248 Reference: http://moodle.org/mod/forum/discuss.php?d=198623 MSA-12-0016: Default repository capabilities issue (CVE-2012-1157) Affects: 2.2.x, 2.1.x, 2.0.x Fix: http://git.moodle.org/gw?p=moodle.git;a=commit;h=246c2cb8e5af71a7d7c605b8fc9f9563e0fb3bc4 Reference: http://moodle.org/mod/forum/discuss.php?d=198624 MSA-12-0017: Personal information leak issue (CVE-2012-1169) Affects: 2.2.x, 2.1.x, 2.0.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31463 Reference: http://moodle.org/mod/forum/discuss.php?d=198625 MSA-12-0018: Course information leak in Gradebook export (CVE-2012-1158) Affects: 2.2.x, 2.1.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29080 Reference: http://moodle.org/mod/forum/discuss.php?d=198627 MSA-12-0019: Overview report and hidden course issue (CVE-2012-1159) Affects: 2.2.x, 2.1.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29892 Reference: http://moodle.org/mod/forum/discuss.php?d=198628 MSA-12-0020: Forum subscription permission issue (CVE-2012-1160) Affects: 2.2.x, 2.1.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31426 Reference: http://moodle.org/mod/forum/discuss.php?d=198629 MSA-12-0021: Course information leak through tags (CVE-2012-1161) Affects: 2.2.x, 2.1.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31466 Reference: http://moodle.org/mod/forum/discuss.php?d=198630 MSA-12-0022: Security conflict in Web services Affects: 2.2.x, 2.1.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-30495 Reference: http://moodle.org/mod/forum/discuss.php?d=198631 MSA-12-0023: External enrolment plugin context check issue (CVE-2012-1170) Affects: 2.2.x Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31178 Reference: http://moodle.org/mod/forum/discuss.php?d=198632
Created moodle tracking bugs for this issue Affects: fedora-all [bug 809226] Affects: epel-all [bug 809227]
moodle-2.2.2-1.fc17 has been pushed to the Fedora 17 stable repository. moodle-2.0.8-1.fc16 has been pushed to the Fedora 16 stable repository. moodle-1.9.17-1.fc15 has been pushed to the Fedora 15 stable repository.