Paketname
phpmyadmin
Datum
2010-08-30
Advisory ID
MDVSA-2010:163
Betroffene Versionen
CS4.0 x86_64 , CS4.0 i586

Problembeschreibung

Multiple vulnerabilities has been found and corrected in phpmyadmin:

The setup script used to generate configuration can be fooled using
a crafted POST request to include arbitrary PHP code in generated
configuration file. Combined with the ability to save files on the
server, this can allow unauthenticated users to execute arbitrary
PHP code (CVE-2010-3055).

It was possible to conduct a XSS attack using crafted URLs or POST
parameters on several pages (CVE-2010-3056).

This upgrade provides phpmyadmin 2.11.10.1 which is not vulnerable
for these security issues.

Aktualisierte Pakete

CS4.0 x86_64

 98128e82ba787753668e820f5cd807c9  corporate/4.0/x86_64/phpMyAdmin-2.11.10.1-0.1.20060mlcs4.noarch.rpm 
 23ff812db8b70606ddd2961b9bc50f83  corporate/4.0/SRPMS/phpMyAdmin-2.11.10.1-0.1.20060mlcs4.src.rpm

CS4.0 i586

 55f0a4869ae0e3f96583f124b0a85ef5  corporate/4.0/i586/phpMyAdmin-2.11.10.1-0.1.20060mlcs4.noarch.rpm 
 23ff812db8b70606ddd2961b9bc50f83  corporate/4.0/SRPMS/phpMyAdmin-2.11.10.1-0.1.20060mlcs4.src.rpm

Referenzen