Sicherheit: Mehrere Probleme in phpMyAdmin
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in phpMyAdmin
ID: FEDORA-2020-e60ce63865
Distribution: Fedora
Plattformen: Fedora 32
Datum: Mi, 1. April 2020, 22:31
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10802
Applikationen: phpMyAdmin


Fedora Update Notification
2020-04-01 16:31:17.044850

Name : phpMyAdmin
Product : Fedora 32
Version : 5.0.2
Release : 2.fc32
URL : https://www.phpmyadmin.net/
Summary : A web interface for MySQL and MariaDB
Description :
phpMyAdmin is a tool written in PHP intended to handle the administration of
MySQL over the Web. Currently it can create and drop databases,
create/drop/alter tables, delete/edit/add fields, execute any SQL statement,
manage keys on fields, manage privileges,export data into various formats and
is available in 50 languages

Update Information:

The **phpMyAdmin** team announces the release of both **4.9.5** and **5.0.2**.
Both versions contain several security fixes: * PMASA-2020-2 SQL injection
vulnerability in the user accounts page, particularly when changing a password
PMASA-2020-3 SQL injection vulnerability relating to the search feature *
PMASA-2020-4 SQL injection and XSS having to do with displaying results *
Removing of the "options" field for the external transformation. There
are many
other bugs fixes, please see the ChangeLog file included with this release for
full details.

* Tue Mar 24 2020 Remi Collet <remi@remirepo.net> 5.0.2-2
- cleanup httpd configuration
* Sat Mar 21 2020 Remi Collet <remi@remirepo.net> 5.0.2-1
- update to 5.0.2 (2020-03-21, security release)
- use phpmyadmin/twig-i18n-extension instead of twig/extensions

[ 1 ] Bug #1816097 - CVE-2020-10804 phpMyAdmin: SQL injection was found in
retrieval of the current username which could result privilege escalation
[ 2 ] Bug #1816131 - CVE-2020-10803 phpMyAdmin: Inserting specially crafted
code in database tables, retrieving and displaying resuts could result in XSS
[ 3 ] Bug #1816144 - CVE-2020-10802 phpMyAdmin: SQL injection was found in
generating certain queries for search actions which could result in malicious D M

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-e60ce63865' at the command
line. For more information, refer to the dnf documentation available at

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
Pro-Linux @Facebook
Neue Nachrichten