Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in phpMyAdmin
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in phpMyAdmin
ID: MDVSA-2009:026
Distribution: Mandriva
Plattformen: Mandriva Corporate 4.0
Datum: Fr, 23. Januar 2009, 19:45
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4775
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5621
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5622
Applikationen: phpMyAdmin

Originalnachricht

This is a multi-part message in MIME format...

------------=_1232736312-14940-7839


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2009:026
http://www.mandriva.com/security/
_______________________________________________________________________

Package : phpMyAdmin
Date : January 23, 2009
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

Cross-site scripting (XSS) vulnerability in pmd_pdf.php allows
remote attackers to inject arbitrary web script or HTML by
using db script parameter when register_global php parameter is
enabled (CVE-2008-4775).

Cross-site request forgery (CSRF) vulnerability in tbl_structure.php
allows remote attackers perform SQL injection and execute arbitrary
code by using table script parameter (CVE-2008-5621).

Multiple cross-site request forgery (CSRF) vulnerabilities in allows
remote attackers perform SQL injection by using unknown vectors
related to table script parameter (CVE-2008-5622).

This update provide the fix for these security issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4775
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5621
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5622
_______________________________________________________________________

Updated Packages:

Corporate 4.0:
7589375efc20c24aec34469a8fcc05e8
corporate/4.0/i586/phpMyAdmin-2.11.9.4-0.1.20060mlcs4.noarch.rpm
fb84268bcbb158d12dbf17dade4c6007
corporate/4.0/SRPMS/phpMyAdmin-2.11.9.4-0.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
7589375efc20c24aec34469a8fcc05e8
corporate/4.0/x86_64/phpMyAdmin-2.11.9.4-0.1.20060mlcs4.noarch.rpm
fb84268bcbb158d12dbf17dade4c6007
corporate/4.0/SRPMS/phpMyAdmin-2.11.9.4-0.1.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJeeYWmqjQ0CJFipgRAjKGAKC8xyS5hfkxIXCdLlwXDCzc8wSSWQCfYhZW
flqnZevpx1QiCbzxUxLB2k4=
=5fPr
-----END PGP SIGNATURE-----


------------=_1232736312-14940-7839
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1232736312-14940-7839--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung