mahara-packaging team mailing list archive

Thread
Date

[Bug 780917] Re: Major security updates for Mahara

To: mahara-packaging@xxxxxxxxxxxxxxxxxxx
From: François Marier <francois@xxxxxxxxxx>
Date: Wed, 11 May 2011 05:31:07 -0000
Reply-to: Bug 780917 <780917@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

All of these patches were tested in their respective distro versions.

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1402

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1403

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1404

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1405

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-1406

-- 
You received this bug notification because you are a member of Mahara
Packaging, which is subscribed to mahara in Ubuntu.
https://bugs.launchpad.net/bugs/780917

Title:
  Major security updates for Mahara

Status in “mahara” package in Ubuntu:
  New

Bug description:
  Binary package hint: mahara

  Here are packages to fix a number of very serious security issues in
  all versions of Mahara:

   * fixes to session key validation (CSRF)
   * privilege escalations
   * information disclosure in AJAX calls
   * https to http downgrade
   * sanitisation of HTML emails