https://bugzilla.novell.com/show_bug.cgi?id=650155 https://bugzilla.novell.com/show_bug.cgi?id=650155#c1 Lars Vogdt changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium Status|NEW |NEEDINFO CC| |lrupp@novell.com InfoProvider| |security-team@suse.de AssignedTo|bnc-team-screening@forge.pr |lrupp@novell.com |ovo.novell.com | Target Milestone|--- |Final --- Comment #1 from Lars Vogdt 2010-10-29 10:13:35 UTC --- As in former days, I like to request a security update to this version for the package moodle on openSUSE 11.1.... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=650155 https://bugzilla.novell.com/show_bug.cgi?id=650155#c3 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |maint:running:36821:moderat | |e --- Comment #3 from Swamp Workflow Management 2010-10-29 11:26:57 UTC --- The SWAMPID for this issue is 36821. This issue was rated as moderate. Please submit fixed packages until 2010-11-12. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=650155 https://bugzilla.novell.com/show_bug.cgi?id=650155#c5 --- Comment #5 from Sebastian Krahmer 2010-11-08 08:03:17 UTC --- From: "Steven M. Christey" While many of the sources for YUI imply that there's only one XSS, one of our CVE analysts observed that the "Affected Files and Patches" section at the end of http://yuilibrary.com/support/2.8.2/ makes it clear that three separate .SWF files are affected, and they are all patched in slightly different versions. So, I'm going to REJECT CVE-2010-3866 and SPLIT it into the following 3 CVEs: CVE-2010-4207 charts/assets/charts.swf YUI 2.4.0 through 2.8.1 CVE-2010-4208 uploader/assets/uploader.swf YUI 2.5.0 through 2.8.1 CVE-2010-4209 swfstore/swfstore.swf YUI 2.8.0 through 2.8.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=650155 https://bugzilla.novell.com/show_bug.cgi?id=650155#c7 --- Comment #7 from Thomas Biege 2010-11-11 15:00:41 UTC --- CVE-2010-4207: CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) CVE-2010-4207: Cross-Site Scripting (XSS) (CWE-79) CVE-2010-4208: CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) CVE-2010-4208: Cross-Site Scripting (XSS) (CWE-79) CVE-2010-4209: CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) CVE-2010-4209: Cross-Site Scripting (XSS) (CWE-79) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=650155 https://bugzilla.novell.com/show_bug.cgi?id=650155#c9 Thomas Biege changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #9 from Thomas Biege 2010-11-12 09:03:17 UTC --- released -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.