Fixes security vulnerability in YUI.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following security issues have been discovered in Bugzilla :

  - There is a way to inject both headers and content to     users, causing a serious Cross-Site Scripting     vulnerability.

  - It was possible to see graphs from Old Charts even if     you did not have access to a particular product, and you     could browse a particular URL to see all product names.

  - YUI 2.8.1, which shipped with Bugzilla starting with     3.7.x, contained a security vulnerability. The version     of YUI shipped with Bugzilla 4.0rc1 and above has been     updated to 2.8.2.

These are tracked by CVE-2010-3764.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The YUI team reports :

A security-related defect was introduced in the YUI 2 Flash component infrastructure beginning with the YUI 2.4.0 release. This defect allows JavaScript injection exploits to be created against domains that host affected YUI .swf files.

This update of moodle fixes :

  - CVE-2010-4207: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS)     (CWE-79) Cross-site scripting vulnerability in the Flash     component infrastructure in YUI allows remote attackers     to inject arbitrary web script or HTML via     charts/assets/charts.swf.

  - CVE-2010-4208: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS)     (CWE-79) Cross-site scripting vulnerability in the Flash     component infrastructure in YUI allows remote attackers     to inject arbitrary web script or HTML via     uploader/assets/uploader.swf.

  - CVE-2010-4209: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS)     (CWE-79) Cross-site scripting vulnerability in the Flash     component infrastructure in YUI allows remote attackers     to inject arbitrary web script or HTML via     swfstore/swfstore.swf.

The version of the YUI library of JavaScript utilities and controls hosted on the remote web server includes at least one SWF file that is affected by an unspecified cross-site scripting vulnerability.

An attacker can leverage this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.

ID	Name	Product	Family	Published	Updated	Severity
50587	Fedora 14 : moodle-1.9.10-1.fc14 (2010-16764)	Nessus	Fedora Local Security Checks	11/15/2010	1/11/2021	medium
50588	Fedora 13 : moodle-1.9.10-1.fc13 (2010-16782)	Nessus	Fedora Local Security Checks	11/15/2010	1/11/2021	medium
50594	Fedora 12 : bugzilla-3.4.9-1.fc12 (2010-17235)	Nessus	Fedora Local Security Checks	11/15/2010	1/11/2021	medium
51194	FreeBSD : YUI JavaScript library -- JavaScript injection exploits in Flash components (d560b346-08a2-11e0-bcca-0050568452ac)	Nessus	FreeBSD Local Security Checks	12/16/2010	1/6/2021	medium
53681	openSUSE Security Update : moodle (openSUSE-SU-2010:0937-1)	Nessus	SuSE Local Security Checks	5/5/2011	1/14/2021	medium
50595	Fedora 14 : bugzilla-3.6.3-1.fc14 (2010-17274)	Nessus	Fedora Local Security Checks	11/15/2010	1/11/2021	medium
50596	Fedora 13 : bugzilla-3.4.9-1.fc13 (2010-17280)	Nessus	Fedora Local Security Checks	11/15/2010	1/11/2021	medium
50495	YUI charts.swf / swfstore.swf / uploader.swf XSS	Nessus	CGI abuses : XSS	11/5/2010	4/11/2022	medium
50589	Fedora 12 : moodle-1.9.10-1.fc12 (2010-16845)	Nessus	Fedora Local Security Checks	11/15/2010	1/11/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium