Login
All errata/sisyphus_loongarch64/ALT-PU-2025-16564-1
ALT-PU-2025-16564-1

Package update moodle in branch sisyphus_loongarch64

Version5.1.1-alt1
Task#0
Published2025-12-09
Max severityHIGH
Severity:

Closed issues (18)

CVE-2025-54869
MEDIUM6.0

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that uses FPDI to process user-supplied PDF files is at risk, causing a Denial of Service (DoS) vulnerability. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability. This issue is fixed in version 2.6.3.

Published: 2025-08-05Modified: 2026-06-17
CVSS 4.0MEDIUM 6.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
CVE-2025-62393
MEDIUM4.3

A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.

Published: 2025-10-23Modified: 2026-06-17
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-25wf-7x6c-wmpf
MEDIUM5.3

Moodle does not properly enforce MFA

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
GHSA-422v-w6c5-vq42
MEDIUM4.3

Moodle exposed the names of hidden groups to users

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-8fcv-4qp9-pg32
MEDIUM4.3

Moodle sends quiz-related messages to inactive/suspended users

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-c5cj-xp43-qcc3
MEDIUM5.3

Moodle's error handling leads to sensitive information disclosure

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
GHSA-jxhh-4648-vpp3
MEDIUM6.0

FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

Published: 2025-08-05Modified: 2025-08-06
CVSS 4.0MEDIUM 6.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
GHSA-m58f-9pvv-8mp2
HIGH7.5

Moodle vulnerable to brute-force password guesses

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-rjcm-7v2p-9265
MEDIUM4.3

Moodle course access permissions are not properly checked in course_output_fragment_course_overview

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
GHSA-w29j-8phw-ffjf
MEDIUM5.4

Moodle has a time restriction bypass

Published: 2025-10-23Modified: 2025-10-24
CVSS 3.xMEDIUM 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References