[ubuntu/vivid-proposed] moodle 2.7.5+dfsg-3 (Accepted)

[Colin Watson]

moodle (2.7.5+dfsg-3) unstable; urgency=high

  * debian/README.Debian: add authors and dates, in order to make status more
    clear.
  * debian/watch: (trying to) get it working again, with revamped moodle.org website.
  * debian/changelog: add even more CVE-numbers to entry 2.7.5+dfsg-1.
  * For the record, https://security-tracker.debian.org/tracker/CVE-2013-3630
    will not get fixed: it's not a bug: the attack can only get launched by an
    administrator, and administrators need to be trusted.  See also Debian
    bug #775842.
  * Fix CVE-2014-4172 and CVE-2014-2054:
    - debian/rules, debian/control: don't use CAS client library as shipped with
      moodle (unchanged phpCAS 1.3.3, see upstream auth/cas/CAS/moodle_readme.txt)
      but php-cas as shipped with Debian (1.3.3-1 and 1.3.1-4+deb7u1); create
      symlinks /u/s/m/auth/cas/CAS/CAS.php -> /usr/share/php/CAS.php
      and /u/s/m/auth/cas/CAS/CAS -> /usr/share/php/CAS/.  This fixes CVE-2014-4172.
    - debian/rules: remove /u/s/m/lib/phpexcel from binary package.  Remove
      lib/phpexcel/PHPExcel/Shared/OLE* from upstream sources.  This fixes both a
      license problem and a security problem: Although the PHP license is generally
      agreed to be DFSG-free, using it as a license on anything that isn't PHP
      itself makes the result non-free.  PHP OLE is licensed under the PHP license.
      Older versions of PHP Excel, such as the one shipped with moodle, suffer from
      security problem CVE-2014-2054.  See also Debian Bug #718585 "RFP: php-excel".
    This closed Debian bug "Multiple security issues"; thanks Moritz Muehlenhoff,
    Thijs Kinkhorst and Hubert Chathi (Closes: #775842)

Date: 2015-03-09 16:14:57.628425+00:00
Signed-By: Colin Watson <cjwatson at canonical.com>
https://launchpad.net/ubuntu/+source/moodle/2.7.5+dfsg-3
-------------- next part --------------
Sorry, changesfile not available.