Hola,
Hem rebut un correu (us el copiem a sota) de Moodle Security Alerts. Nosaltres no hem de fer res, oi? No som conscients d'haver demanat informació sobre seguretat, tal i com suggereix el mail.
Aqui va la còpia. Ja ens direu si hem de fer quelcom.
----
---------- Forwarded message ----------
From: Moodle Security Alerts <securityalerts@moodle.org>
Date: 2015-05-11 5:21 GMT+02:00
Subject: Moodle 2.9, 2.8.6, 2.7.8 and 2.6.11 are now available
To: Administrador/a a8046608 <a8046608@xtec.cat>
A Message for Registered Moodle Administrators
This email is going out to many thousands of registered Moodle admins. You are receiving this email because you asked for Moodle security news when you registered a Moodle site. If you don't want these emails then please re-register your site with your new preferences or use the unsubscribe link below. Replies to this email will not be read.
I'm writing today to let you know that Moodle 2.9, 2.8.6, 2.7.8 and 2.6.11 are available via the usual open download channels: http://download.moodle.org or Git.
Note that the 2.7 branch from now on is supported for security fixes only untill May 2017 and 2.6 branch is no longer supported.
Release notes are available for each new version.
- Moodle 2.9 release notes
- Moodle 2.8.6 release notes
- Moodle 2.7.8 release notes
- Moodle 2.6.11 release notes
Security Issues
As well as a long list of bug fixes, performance improvements and polishing, there are security issues you should be aware of. Details of these security issues are listed below.
As a registered Moodle admin we are giving you advance notice of these issues so you have some time to fix them before we publish them more widely on http://moodle.org/security in one week.
To avoid leaving your site vulnerable, we highly recommend you upgrade your sites to the latest Moodle version as soon as you can. If you cannot upgrade, then please check the following list carefully and patch your own system or switch off those features.
Thanks
Thanks, as always, to EVERYONE involved in reporting and fixing issues. It really is a team effort and one with more and more people involved all the time.
Thanks for using Moodle and being part of the Moodle open source community.
Marina Glancy
Development Process Manager, Moodle HQ
==============================================================================
MSA-15-0018: Quiz manual-grading is an XSS risk, but does not declare that
Description: Leaving gradebook feedback is a trusted action and such
capabilities in other modules already have XSS mask,
'mod/quiz:grade' was missing this flag.
Issue summary: Quiz manual-grading is an XSS risk, but does not declare
that
Severity/Risk: Minor
Versions affected: 2.8 to 2.8.5, 2.7 to 2.7.7, 2.6 to 2.6.10 and earlier
unsupported versions
Versions fixed: 2.9, 2.8.6, 2.7.8 and 2.6.11
Reported by: Hugh Davenport
Issue no.: MDL-49941
CVE identifier: CVE-2015-3174
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49941
==============================================================================
MSA-15-0019: Possible phishing when redirecting to external site using referer
header
Description: Some error messages in Moodle display button to return to
previous page. Redirecting to non-local referer should not
be allowed as it can potentially be used for phising.
Issue summary: get_referer() used with redirect() can be insecure
Severity/Risk: Minor
Versions affected: 2.8 to 2.8.5, 2.7 to 2.7.7, 2.6 to 2.6.10 and earlier
unsupported versions
Versions fixed: 2.9, 2.8.6, 2.7.8 and 2.6.11
Reported by: Dingjie Yang
Issue no.: MDL-49179
CVE identifier: CVE-2015-3175
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49179
==============================================================================
MSA-15-0020: User fullname disclosure through account confirmation link
Description: On the sites with enabled self-registration not registered
users can retrieve fullname of registered users knowing
their usernames
Issue summary: User fullname disclosure through account confirmation link
Severity/Risk: Serious
Versions affected: 2.8 to 2.8.5, 2.7 to 2.7.7, 2.6 to 2.6.10 and earlier
unsupported versions
Versions fixed: 2.9, 2.8.6, 2.7.8 and 2.6.11
Reported by: Federico Kirschbaum
Issue no.: MDL-50099
Workaround: Even partial patch (removing one line in
/login/confirm.php) will also resolve security issue
CVE identifier: CVE-2015-3176
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50099
==============================================================================
MSA-15-0021: Any authenticated user can subscribe to site-wide event monitor
rules
Description: If the site-wide rules exist in the event monitor tool, any
user can subscribe themselves to them and potentially
access information they are not supposed to see.
Issue summary: Any authenticated user can subscribe to site wide event
monitor rules
Severity/Risk: Minor
Versions affected: 2.8 to 2.8.5
Versions fixed: 2.9 and 2.8.6
Reported by: Adrian Greeve
Issue no.: MDL-50039
Workaround: Do not use site-wide rules until your site is upgraded
CVE identifier: CVE-2015-3177
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50039
==============================================================================
MSA-15-0022: Potential XSS risk when returning text entered by student from
Web Services
Description: If user who is not XSS-trusted attempts to insert the XSS
as part of the input text, it will be cleaned when
displayed on Moodle website but may be displayed uncleaned
in the external application
Issue summary: external_format_text() cleans and formats text incorrectly
Severity/Risk: Serious
Versions affected: 2.8 to 2.8.5, 2.7 to 2.7.7, 2.6 to 2.6.10 and earlier
unsupported versions
Versions fixed: 2.9, 2.8.6, 2.7.8 and 2.6.11
Reported by: Eloy Lafuente
Issue no.: MDL-49718
CVE identifier: CVE-2015-3178
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49718
==============================================================================
MSA-15-0023: Suspended user is able to login when confirming email
Description: When self-registration is enabled and user's account was
suspended after creating account but before actually
confirming it, user is still able to login when confirming
email but only once.
Issue summary: Suspended user is able to login when confirming email
Severity/Risk: Minor
Versions affected: 2.8 to 2.8.5, 2.7 to 2.7.7, 2.6 to 2.6.10 and earlier
unsupported versions
Versions fixed: 2.9, 2.8.6, 2.7.8 and 2.6.11
Reported by: Marina Glancy
Issue no.: MDL-50090
CVE identifier: CVE-2015-3179
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50090
==============================================================================
MSA-15-0024: User with suspended enrolment can see sections in the navigation
tree
Description: If a user is enrolled in the course but his enrollment is
suspended, they can not access the course but still were
able to see course structure in the navigation block
Issue summary: User with suspended enrolment can see sections in the
navigation tree
Severity/Risk: Minor
Versions affected: 2.8 to 2.8.5, 2.7 to 2.7.7, 2.6 to 2.6.10 and earlier
unsupported versions
Versions fixed: 2.9, 2.8.6, 2.7.8 and 2.6.11
Reported by: Alex Mitin
Issue no.: MDL-49788
CVE identifier: CVE-2015-3180
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49788
==============================================================================
MSA-15-0025: Capability to manage own files is not respected in Web
Services
Description: Users with the revoked capability
'moodle/user:manageownfiles' are still able to upload
private files using deprecated function in Web Services
Issue summary: Users with the manageownfiles disabled are able to upload
private files via Web Services
Severity/Risk: Minor
Versions affected: 2.8 to 2.8.5, 2.7 to 2.7.7, 2.6 to 2.6.10 and earlier
unsupported versions
Versions fixed: 2.9, 2.8.6, 2.7.8 and 2.6.11
Reported by: Juan Leyva
Issue no.: MDL-49994
CVE identifier: CVE-2015-3181
Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49994
==============================================================================
Salutacions,
Olga Godoy
Institut Príncep de Viana, BCN