oss-sec mailing list archives
Moodle security release 3.0.4, 2.9.6, 2.8.12, 2.7.14
From: Marina Glancy <marina () moodle com>
Date: Tue, 17 May 2016 17:01:24 +0800
The following security notifications have now been made public following release of Moodle 3.0.4, 2.9.6, 2.8.12 and 2.7.14. Thanks to OSS members for their cooperation. ============================================================================== MSA-16-0013: Users are able to change profile fields that were locked by the administrator Description: User editing form only disabled the profile fields in UI and did not actually prevent users from editing them Issue summary: Tricky users can change locked profile fields Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5, 2.8 to 2.8.11, 2.7 to 2.7.13 and earlier unsupported versions Versions fixed: 3.0.4, 2.9.6, 2.8.12 and 2.7.14 Reported by: Vadim Dvorovenko Issue no.: MDL-53954 CVE identifier: CVE-2016-3729 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53954 ============================================================================== MSA-16-0015: Information disclosure of hidden forum names and sub-names. Description: Name of the inaccessible forum or forum discussion could be disclosed as part of the error message on the subscription page Issue summary: Information disclosure of hidden forum names and sub-names. Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5 and 2.8 to 2.8.11 Versions fixed: 3.0.4, 2.9.6 and 2.8.12 Reported by: Callum Issue no.: MDL-53696 CVE identifier: CVE-2016-3731 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53696 ============================================================================== MSA-16-0016: User can view badges of other users without proper permissions Description: Capability check to view other badges was performed for the current user instead for the user whose badges are being viewed Issue summary: Badges code checks viewotherbadges capability in the wrong context Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5, 2.8 to 2.8.11, 2.7 to 2.7.13 and earlier unsupported versions Versions fixed: 3.0.4, 2.9.6 and 2.8.12 Reported by: Tim Hunt Issue no.: MDL-53589 CVE identifier: CVE-2016-3732 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53589 ============================================================================== MSA-16-0017: Course idnumber not protected from teacher restore Description: During the course restore teacher could overwrite idnumber even without having the capability to change it Issue summary: Course idnumber not protected from teacher restore Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5, 2.8 to 2.8.11, 2.7 to 2.7.13 and earlier unsupported versions Versions fixed: 3.0.4, 2.9.6, 2.8.12 and 2.7.14 Reported by: Donna Hrynkiw Issue no.: MDL-51369 CVE identifier: CVE-2016-3733 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51369 ============================================================================== MSA-16-0018: CSRF in script marking forum posts as read Description: CSRF possible in the URL that marks forum posts as read Issue summary: Forum markposts.php missing sesskey check Severity/Risk: Minor Versions affected: 3.0 to 3.0.3, 2.9 to 2.9.5, 2.8 to 2.8.11, 2.7 to 2.7.13 and earlier unsupported versions Versions fixed: 3.0.4, 2.9.6, 2.8.12 and 2.7.14 Reported by: Andrew Nicols Issue no.: MDL-53755 CVE identifier: CVE-2016-3734 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53755 ============================================================================== Marina Glancy Development Process Manager e: marina () moodle com p: +61 8 9467 4167 w: moodle.com
Current thread:
- Moodle security release 3.0.4, 2.9.6, 2.8.12, 2.7.14 Marina Glancy (May 17)