Description
In Moodle before 2.6.4, serialised data passed by repositories could
potentially contain objects defined by add-ons that could include executable
code (CVE-2014-3541).
In Moodle before 2.6.4, it was possible for manipulated XML files passed from
LTI servers to be interpreted by Moodle to allow access to server-side files
(CVE-2014-3542).
In Moodle before 2.6.4, it was possible for manipulated XML files to be
uploaded to the IMSCC course format or the IMSCP resource to allow access to
server-side files (CVE-2014-3543).
In Moodle before 2.6.4, filtering of the Skype profile field was not removing
potentially harmful code (CVE-2014-3544).
In Moodle before 2.6.4, it was possible to inject code into Calculated
questions that would be executed on the server (CVE-2014-3545).
In Moodle before 2.6.4, it was possible to get limited user information,
such as user name and courses, by manipulating the URL of profile and notes
pages (CVE-2014-3546).
In Moodle before 2.6.4, the details of badges from external sources were not
being filtered (CVE-2014-3547).
In Moodle before 2.6.4, content of exception dialogues presented from AJAX
calls was not being escaped before being presented to users (CVE-2014-3548).
In Moodle before 2.6.4, fields in rubrics were not being correctly filtered
(CVE-2014-3551).
In Moodle before 2.6.4, forum was allowing users who were members of more
than one group to post to all groups without the capability to access all
groups (CVE-2014-3553).
The moodle package has been updated to version 2.6.4, to fix these issues
and other bugs.