Nom du paquet
phpmyadmin
Date
2011-01-05
Advisory ID
MDVSA-2011:000
Affected versions
CS4.0 x86_64 , MES5 i586 , CS4.0 i586 , MES5 x86_64

Problem description

Multiple vulnerabilities has been found and corrected in phpmyadmin:

error.php in PhpMyAdmin 3.3.8.1 and earlier allows remote attackers
to conduct cross-site scripting (XSS) attacks via a crafted BBcode
tag containing @ characters, as demonstrated using [a@url@page]
(CVE-2010-4480).

phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass
authentication and obtain sensitive information via a direct request
to phpinfo.php, which calls the phpinfo function (CVE-2010-4481).

This upgrade provides the latest phpmyadmin version for MES5 (3.3.9)
and patches the version for CS4 to address these vulnerabilities.

Updated packages

CS4.0 x86_64

 b327495c075fd3eaa4809b3e3bd07984  corporate/4.0/x86_64/phpMyAdmin-2.11.11.1-0.2.20060mlcs4.noarch.rpm 
 b30f2eea3b1c157c528bd44ba2576f5d  corporate/4.0/SRPMS/phpMyAdmin-2.11.11.1-0.2.20060mlcs4.src.rpm

MES5 i586

 d0c008da55aa4fa7fe0892d15e15a87a  mes5/i586/phpmyadmin-3.3.9-0.1mdvmes5.1.noarch.rpm 
 17ffcad097ff3dfee9d679c85ffd3ef9  mes5/SRPMS/phpmyadmin-3.3.9-0.1mdvmes5.1.src.rpm

CS4.0 i586

 d07101ccc36cf4e67ae86a8ddc5d5310  corporate/4.0/i586/phpMyAdmin-2.11.11.1-0.2.20060mlcs4.noarch.rpm 
 b30f2eea3b1c157c528bd44ba2576f5d  corporate/4.0/SRPMS/phpMyAdmin-2.11.11.1-0.2.20060mlcs4.src.rpm

MES5 x86_64

 86d7b84ba88a87e5cc18c7531b7c8e95  mes5/x86_64/phpmyadmin-3.3.9-0.1mdvmes5.1.noarch.rpm 
 17ffcad097ff3dfee9d679c85ffd3ef9  mes5/SRPMS/phpmyadmin-3.3.9-0.1mdvmes5.1.src.rpm

References