Bug 201675

Summary: security/vuxml: document www/moodle29 /www/moodle28 /www/moodle27 security advisories
Product: Ports & Packages Reporter: Jason Unovitch <junovitch>
Component: Individual Port(s)Assignee: freebsd-ports-bugs (Nobody) <ports-bugs>
Status: Closed FIXED    
Severity: Affects Some People CC: feld, ports-secteam, wen
Priority: ---    
Version: Latest   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
security/vuxml entries for moodle CVE-2015-3272 -> 3275
none
security/vuxml fixup copy/paste mishap none

Description Jason Unovitch freebsd_committer freebsd_triage 2015-07-18 15:24:10 UTC 
Created attachment 158943 [details]
security/vuxml entries for moodle CVE-2015-3272 -> 3275

Reference:  http://seclists.org/oss-sec/2015/q3/94


Commit log:
- Document recent Moodle security advisories

Security: CVE-2015-3272
Security: CVE-2015-3273
Security: CVE-2015-3274
Security: CVE-2015-3275
Security: 43891162-2d5e-11e5-a4a5-002590263bf5


Validation:
% make validate
/bin/sh /usr/ports/security/vuxml/files/tidy.sh "/usr/ports/security/vuxml/files/tidy.xsl" "/usr/ports/security/vuxml/vuln.xml" > "/usr/ports/security/vuxml/vuln.xml.tidy"
>>> Validating...
/usr/local/bin/xmllint --valid --noout /usr/ports/security/vuxml/vuln.xml
>>> Successful.
Checking if tidy differs...
... seems okay
Checking for space/tab...
... seems okay
/usr/local/bin/python2.7 /usr/ports/security/vuxml/files/extra-validation.py /usr/ports/security/vuxml/vuln.xml

% env PKG_DBDIR=/usr/ports/security/vuxml pkg audit moodle29-2.9.0
moodle29-2.9.0 is vulnerable:
moodle -- multiple vulnerabilities
CVE: CVE-2015-3275
CVE: CVE-2015-3274
CVE: CVE-2015-3273
CVE: CVE-2015-3272
WWW: https://vuxml.FreeBSD.org/freebsd/43891162-2d5e-11e5-a4a5-002590263bf5.html

1 problem(s) in the installed packages found.

% env PKG_DBDIR=/usr/ports/security/vuxml pkg audit moodle29-2.9.1
0 problem(s) in the installed packages found.
Comment 1 Jason Unovitch freebsd_committer freebsd_triage 2015-07-18 15:27:00 UTC 
wen@,
r391620, r391625, and r391628 were all committed on 9 July for this but as of yet 2015Q3 still needs an MFH of those updates.
Comment 2 Mark Felder freebsd_committer freebsd_triage 2015-07-18 23:13:08 UTC 
Thanks Jason, I'll take this
Comment 3 commit-hook freebsd_committer freebsd_triage 2015-07-18 23:17:01 UTC 
A commit references this bug:

Author: feld
Date: Sat Jul 18 23:16:06 UTC 2015
New revision: 392471
URL: https://svnweb.freebsd.org/changeset/ports/392471

Log:
  Document recent Moodle security advisories

  Security:	CVE-2015-3272
  Security:	CVE-2015-3273
  Security:	CVE-2015-3274
  Security:	CVE-2015-3275
  Security:	43891162-2d5e-11e5-a4a5-002590263bf5

  PR:		201675

Changes:
  head/security/vuxml/vuln.xml
Comment 4 commit-hook freebsd_committer freebsd_triage 2015-07-18 23:19:03 UTC 
A commit references this bug:

Author: feld
Date: Sat Jul 18 23:18:31 UTC 2015
New revision: 392472
URL: https://svnweb.freebsd.org/changeset/ports/392472

Log:
  MFH: r391620

  - Update to 2.9.1
  - Update options
  - Add missing php module
  - Fix file permissions

  Security:	43891162-2d5e-11e5-a4a5-002590263bf5
  Security:	CVE-2015-3272
  Security:	CVE-2015-3273
  Security:	CVE-2015-3274
  Security:	CVE-2015-3275
  PR:	201675
  Approved by:	ports-secteam (with hat)

Changes:
_U  branches/2015Q3/
  branches/2015Q3/www/moodle29/Makefile
  branches/2015Q3/www/moodle29/distinfo
Comment 5 commit-hook freebsd_committer freebsd_triage 2015-07-18 23:20:05 UTC 
A commit references this bug:

Author: feld
Date: Sat Jul 18 23:19:24 UTC 2015
New revision: 392473
URL: https://svnweb.freebsd.org/changeset/ports/392473

Log:
  MFH: r391625

  - Update to 2.8.7
  - Update options
  - Add missing php module
  - Fix file permissions
  - Adjust CONFLICTS
  Security:       43891162-2d5e-11e5-a4a5-002590263bf5
  Security:       CVE-2015-3272
  Security:       CVE-2015-3273
  Security:       CVE-2015-3274
  Security:       CVE-2015-3275
  PR:     	201675
  Approved by:    ports-secteam (with hat)

Changes:
_U  branches/2015Q3/
  branches/2015Q3/www/moodle28/Makefile
  branches/2015Q3/www/moodle28/distinfo
Comment 6 commit-hook freebsd_committer freebsd_triage 2015-07-18 23:21:07 UTC 
A commit references this bug:

Author: feld
Date: Sat Jul 18 23:20:10 UTC 2015
New revision: 392474
URL: https://svnweb.freebsd.org/changeset/ports/392474

Log:
  MFH: r391628

  - Update to 2.7.9
  - Update options
  - Add missing php module
  - Fix file permissions
  - Adjust CONFLICTS
  - Mark DEPRECTED

  Security:       43891162-2d5e-11e5-a4a5-002590263bf5
  Security:       CVE-2015-3272
  Security:       CVE-2015-3273
  Security:       CVE-2015-3274
  Security:       CVE-2015-3275
  PR:     	201675
  Approved by:    ports-secteam (with hat)

Changes:
_U  branches/2015Q3/
  branches/2015Q3/www/moodle27/Makefile
  branches/2015Q3/www/moodle27/distinfo
Comment 7 Jason Unovitch freebsd_committer freebsd_triage 2015-07-19 14:14:06 UTC 
Created attachment 158972 [details]
security/vuxml fixup copy/paste mishap

Mark,
Thanks! I just realized I had a copy/paste mishap with the references to the release notes. I cited 2.7.9 twice. Can you apply this patch to fix that up? Sorry for that.
Comment 8 commit-hook freebsd_committer freebsd_triage 2015-07-20 14:52:58 UTC 
A commit references this bug:

Author: feld
Date: Mon Jul 20 14:52:07 UTC 2015
New revision: 392575
URL: https://svnweb.freebsd.org/changeset/ports/392575

Log:
  Fix moodle reference URL

  PR:		201675
  Security:	43891162-2d5e-11e5-a4a5-002590263bf5

Changes:
  head/security/vuxml/vuln.xml