Upstream has issued an advisory on October 23: https://www.phpmyadmin.net/security/PMASA-2015-5/ Debian has issued an advisory for this on October 28: https://www.debian.org/security/2015/dsa-3382 Updated package uploaded for Cauldron. Patched package uploaded for Mageia 5. Advisory: ======================== Updated phpmyadmin package fixes security vulnerability: Content spoofing vulnerability when redirecting user to an external site (CVE-2015-7873). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7873 https://www.phpmyadmin.net/security/PMASA-2015-5/ https://www.debian.org/security/2015/dsa-3382 ======================== Updated packages in core/updates_testing: ======================== phpmyadmin-4.2.13.3-1.2.mga5 from phpmyadmin-4.2.13.3-1.2.mga5.src.rpm Reproducible: Steps to Reproduce:
Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=12834#c7 https://bugs.mageia.org/show_bug.cgi?id=14208#c6
Whiteboard: (none) => has_procedure
In VirtualBox, M5, KDE, 32-bit Package(s) under test: mariadb phpmyadmin default install of mariadb & phpmyadmin [root@localhost wilcal]# urpmi mariadb Package mariadb-10.0.21-1.mga5.i586 is already installed [root@localhost wilcal]# urpmi phpmyadmin Package phpmyadmin-4.2.13.3-1.1.mga5.noarch is already installed start mysqladmin, set password, open http://localhost/phpmyadmin/ create new database called dbase1. Close browser. Successfully reopen: http://localhost/phpmyadmin/ install phpmyadmin from updates_testing [root@localhost wilcal]# urpmi mariadb Package mariadb-10.0.21-1.mga5.i586 is already installed [root@localhost wilcal]# urpmi phpmyadmin Package phpmyadmin-4.2.13.3-1.2.mga5.noarch is already installed open http://localhost/phpmyadmin/ create new database called dbase2. Close browser. Successfully reopen: http://localhost/phpmyadmin/ open dbase1 open dbase2
CC: (none) => wilcal.int
In VirtualBox, M5, KDE, 64-bit Package(s) under test: mariadb phpmyadmin default install of mariadb & phpmyadmin [root@localhost wilcal]# urpmi mariadb Package mariadb-10.0.21-1.mga5.x86_64 is already installed [root@localhost wilcal]# urpmi phpmyadmin Package phpmyadmin-4.2.13.3-1.1.mga5.noarch is already installed start mysqladmin, set password, open http://localhost/phpmyadmin/ create new database called dbase1. Close browser. Successfully reopen: http://localhost/phpmyadmin/ install phpmyadmin from updates_testing [root@localhost wilcal]# urpmi mariadb Package mariadb-10.0.21-1.mga5.x86_64 is already installed [root@localhost wilcal]# urpmi phpmyadmin Package phpmyadmin-4.2.13.3-1.2.mga5.noarch is already installed open http://localhost/phpmyadmin/ create new database called dbase2. Close browser. Successfully reopen: http://localhost/phpmyadmin/ open dbase1 open dbase2
This looks good to go David. What you say?
Oking based on comment 3, and validating the update.
Keywords: (none) => validated_updateWhiteboard: has_procedure => has_procedure MGA5-64-OK advisoryCC: (none) => davidwhodgins, sysadmin-bugs
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0419.html
Status: NEW => RESOLVEDResolution: (none) => FIXED