Upstream has issued an advisory today (October 21): http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php The issue is fixed in 4.1.14.6 and 4.2.10.1. Freeze push requested for Cauldron. Updated packages uploaded for Mageia 3 and Mageia 4. Advisory: ======================== Updated phpmyadmin package fixes security vulnerability: In phpMyAdmin before 4.1.14.6, with a crafted database or table name it is possible to trigger an XSS in SQL debug output when enabled and in server monitor page when viewing and analysing executed queries (CVE-2014-8326). References: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8326 http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php ======================== Updated packages in core/updates_testing: ======================== phpmyadmin-4.1.14.6-1.mga3 phpmyadmin-4.1.14.6-1.mga4 from SRPMS: phpmyadmin-4.1.14.6-1.mga3.src.rpm phpmyadmin-4.1.14.6-1.mga4.src.rpm Reproducible: Steps to Reproduce:
Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=12834#c7 https://bugs.mageia.org/show_bug.cgi?id=14208#c6
Whiteboard: (none) => MGA3TOO has_procedure
Tested mga4-64 with MariaDB Logged in, created new user with its own database. Entered a row into the database, browsed to make sure it was there, then deleted user and database. All behaved as expected.
CC: (none) => wrw105Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure mga4-64-ok
mga3-64 tested as above. All behaved as expected.
Whiteboard: MGA3TOO has_procedure mga4-64-ok => MGA3TOO has_procedure mga4-64-ok mga3-64-ok
tested mga3-32 as above, all OK.
Whiteboard: MGA3TOO has_procedure mga4-64-ok mga3-64-ok => MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok
Tested mga4-32 as above, all OK. Validating. Ready for push to /core/updates when advisory is uploaded to svn.
Keywords: (none) => validated_updateWhiteboard: MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok => MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok mga4-32-okCC: (none) => sysadmin-bugs
Advisory uploaded. CVEs are dangerously nearing the end of their four-digits naming scheme :-o
CC: (none) => remiWhiteboard: MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok mga4-32-ok => MGA3TOO has_procedure mga4-64-ok mga3-64-ok mga3-32-ok mga4-32-ok advisory
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2014-0420.html
Status: NEW => RESOLVEDResolution: (none) => FIXED
URL: (none) => http://lwn.net/Vulnerabilities/617976/