----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
Debian update for moodle

SECUNIA ADVISORY ID:
SA33239

VERIFY ADVISORY:
http://secunia.com/advisories/33239/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Cross Site Scripting

WHERE:
>From remote

OPERATING SYSTEM:
Debian GNU/Linux 4.0
http://secunia.com/advisories/product/13844/
Debian GNU/Linux unstable alias sid
http://secunia.com/advisories/product/530/

DESCRIPTION:
Debian has issued an update for moodle. This fixes some
vulnerabilities, which can be exploited by malicious users to conduct
script insertion attacks, and by malicious people to bypass certain
security restrictions or conduct cross-site request forgery and
cross-site scripting attacks.

For more information:
SA25929
SA31017
SA31196
SA32329
SA32361
SA33079

NOTE: This update also fixes several vulnerabilities in the embedded
Smarty and Snoopy files.

SOLUTION:
Apply updated packages.

-- Debian GNU/Linux 4.0 alias etch --

Source archives:

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1.diff.gz
Size/MD5 checksum: 24019 d29c179786ca1dcadf232c5e9a601362
http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3.orig.tar.gz
Size/MD5 checksum: 7465709 2f9f3fcf83ab0f18c409f3a48e07eae2
http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1.dsc
Size/MD5 checksum: 793 d9a1fceaf316b608709be372d97e667a

Architecture independent packages:

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1_all.deb
Size/MD5 checksum: 6592474 9a5fb5924faa639952c3171665bc347d

-- Debian GNU/Linux unstable alias sid --

Fixed in version 1.8.2.dfsg-2.

ORIGINAL ADVISORY:
http://www.us.debian.org/security/2008/dsa-1691

OTHER REFERENCES:
SA25929:
http://secunia.com/advisories/25929/

SA31017:
http://secunia.com/advisories/31017/

SA31196:
http://secunia.com/advisories/31196/

SA32329:
http://secunia.com/advisories/32329/

SA32361:
http://secunia.com/advisories/32361/

SA33079:
http://secunia.com/advisories/33079/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------