drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in phppgadmin
Name: |
Mehrere Probleme in phppgadmin |
|
ID: |
DSA-1693-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian sid, Debian etch |
|
Datum: |
Sa, 27. Dezember 2008, 13:01 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2865
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5728
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5587 |
|
Applikationen: |
phpPgAdmin |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
- ------------------------------------------------------------------------ Debian Security Advisory DSA-1693-1 security@debian.org http://www.debian.org/security/ Thijs Kinkhorst December 27, 2008 http://www.debian.org/security/faq - ------------------------------------------------------------------------
Package : phppgadmin Vulnerability : several Problem type : remote Debian-specific: no CVE Id(s) : CVE-2007-2865 CVE-2007-5728 CVE-2008-5587 Debian Bugs : 427151 449103 508026
Several remote vulnerabilities have been discovered in phpPgAdmin, a tool to administrate PostgreSQL database over the web. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2007-2865
Cross-site scripting vulnerability allows remote attackers to inject arbitrary web script or HTML via the server parameter.
CVE-2007-5728
Cross-site scripting vulnerability allows remote attackers to inject arbitrary web script or HTML via PHP_SELF.
CVE-2008-5587
Directory traversal vulnerability allows remote attackers to read arbitrary files via _language parameter.
For the stable distribution (etch), these problems have been fixed in version 4.0.1-3.1etch1.
For the unstable distribution (sid), these problems have been fixed in version 4.2.1-1.1.
We recommend that you upgrade your phppgadmin package.
Upgrade instructions - --------------------
wget url will fetch the file for you dpkg -i file.deb will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given below:
apt-get update will update the internal database apt-get upgrade will install corrected packages
You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch - -------------------------------
Source archives:
phppgadmin_4.0.1.orig.tar.gz Size/MD5 checksum: 703673 eedac65ce5d73aca2f92388c9766ba1b phppgadmin_4.0.1-3.1etch1.dsc Size/MD5 checksum: 890 e6dea463d597f6dda40d774820e3bb03 phppgadmin_4.0.1-3.1etch1.diff.gz Size/MD5 checksum: 15678 1cbe0f619e65a8c49894e8c0fe015fb5
Architecture independent packages:
phppgadmin_4.0.1-3.1etch1_all.deb Size/MD5 checksum: 704386 1f5b68f6be269eb3c10646cd8d69c31c
These files will probably be moved into the stable distribution on its next update.
- --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-securitydists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBSVYXX2z0hbPcukPfAQL7Jgf8D01CiY6dpQO7AUmDCU/sNIHnMudx5ZEC y/Yk0b2raMmtJeejXpdD4zRpPGOIx4LBefh2BmyyC18vPzdjbX/5MbXvOewmeqm3 6eI6clMf5rpbb7jnzL1SxqMwt+7YocmU30JiWMbuXggrCUpawsxROTMIJkVqT86c Yg8DKOWpLt43YAYl+IRx2sbmDP/kGN2omn6pBnkqcIeQh8wB7CNmSEeSlkH0iOTS EoTOyjTWhTFAz1T8bG6A6YSmgBSTZ+tEb1eqODMB1y8POQ7k4B4MmCA1OPNtJuoq EEB2KoaDJkkhS8anv2fyYEmufZBTqD8AGsFPGttqSMBQyR9XdYD5cg== =J4km -----END PGP SIGNATURE-----
-- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
|
|
|
|