Bug 10755

For testing instructions, see:
https://bugs.mageia.org/show_bug.cgi?id=10136#c3

Advisory:
========================

Updated moodle package fix security vulnerabilities:

Flash files distributed with the YUI library in Moodle before 2.4.5 may have
allowed for cross-site scripting attacks (MSA-13-0025).

Privacy settings for the IMS-LTI (External tool) module in Moodle before
2.4.5 were not able to be changed so personal information was always
transferred (MSA-13-0026).

Users were able to access a daemon-mode Chat activity in Moodle before 2.4.5
without the required capability (CVE-2013-2242).

It was possible to determine answers from ID values in Lesson activity
matching questions in Moodle before 2.4.5 (CVE-2013-2243).

Conditional access rule values for user fields were able to contain unescaped
HTML/JS that would be output to users in Moodle before 2.4.5 (CVE-2013-2244).

When impersonating another user using RSS tokens in Moodle before 2.4.5, an
error was displayed, but block information relevant to the person being
impersonated was shown (CVE-2013-2245).

The Feedback module in Moodle before 2.4.5 was showing personal information 
to users without the needed capability (CVE-2013-2246).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2242
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2243
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2245
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2246
https://moodle.org/mod/forum/discuss.php?d=232496
https://moodle.org/mod/forum/discuss.php?d=232497
https://moodle.org/mod/forum/discuss.php?d=232498
https://moodle.org/mod/forum/discuss.php?d=232500
https://moodle.org/mod/forum/discuss.php?d=232501
https://moodle.org/mod/forum/discuss.php?d=232502
https://moodle.org/mod/forum/discuss.php?d=232503
http://docs.moodle.org/dev/Moodle_2.4.5_release_notes
https://moodle.org/mod/forum/discuss.php?d=232108

Severity: normal => major

Procedure: https://bugs.mageia.org/show_bug.cgi?id=10136#c3

To get this up and running, it's similar to other web app packages.

Simplest way:
urpmi mariadb
systemctl enable mysqld.service
systemctl start mysqld.service
mysql -u root 
mysql> create database moodle;
mysql> create user 'moodle'@'localhost' identified by '<PASSWORD>';
mysql> grant all on moodle.* to 'moodle'@'localhost';
mysql> ALTER DATABASE moodle DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;
mysql> exit;

Then, edit /var/www/moodle/config.php, and in the empty single quotes for dbuser and dbpass, put 'moodle' for dbuser (or whatever user you created in the create user command in mysql), and the password you used in the create user mysql command in for dbpass.

Then browse to http://localhost/moodle to complete the setup.

There's a lot more documentation on using moodle at:
http://docs.moodle.org/24/en/Main_page

Sorry David, I didn't notice you'd already given a link.

Testing mga3 64

Installed and configured with the admin user and created a sample course.

Installed the update candidate and it then offered to upgrade the database and one plugin, I thought I'd remember it's name but I don't :\

All OK after doing so, the login and course are still present.

Testing complete mga3 64

Whiteboard: has_procedure => has_procedure mga3-64-ok

Testing mga3 32

Testing complete mga3 32

Whiteboard: has_procedure mga3-64-ok => has_procedure mga3-64-ok mga3-32-ok

Validating. Advisory from comment 0 uploaded.

Could sysadmin please push from 3 core/updates_testing to core/updates

Thanks!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

http://advisories.mageia.org/MGASA-2013-0217.html

Status: NEW => RESOLVED
CC: (none) => boklm
Resolution: (none) => FIXED