Developers

developers@phpmyadmin.net

3 participants
7004 discussions

[Phpmyadmin-devel] [Fwd: Re: CVE for phpMyAdmin PMASA-2007-6]
by Thijs Kinkhorst 24 Oct '07

24 Oct '07

Hi devs, I requested a CVE id to be assigned for PMASA-2007-6, which is quoted below. If I have spotted it correctly, I see not much use of CVE id's within phpMyAdmin. It would be very helpful for security workers in e.g. distributions if the PMASA advisories would mention the corresponding CVE numbers when such a number is or becomes available. It could also have a place in the relevant changelog entry that fixes the problem. Would you consider doing that? Thanks Thijs (also on behalf of the Debian security team) ---------------------------- Original Message ---------------------------- Subject: Re: CVE for phpMyAdmin PMASA-2007-6 From: "Steven M. Christey" <coley(a)linus.mitre.org> Date: Mon, October 22, 2007 22:19 To: "Thijs Kinkhorst" <thijs(a)debian.org> Cc: cve(a)mitre.org -------------------------------------------------------------------------- Hello, Use CVE-2007-5589 - Steve ====================================================== Name: CVE-2007-5589 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5589 Reference: MISC:http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html Reference: CONFIRM:http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MA… Reference: CONFIRM:http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&re… Reference: CONFIRM:http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6 Reference: FRSIRT:ADV-2007-3535 Reference: URL:http://www.frsirt.com/english/advisories/2007/3535 Reference: SECUNIA:27246 Reference: URL:http://secunia.com/advisories/27246 Muliple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI.

2 2

[Phpmyadmin-devel] phpMyAdmin 2.11.2-rc1 is released
by Marc Delisle 23 Oct '07

23 Oct '07

Welcome to phpMyAdmin 2.11.2-rc1, the first release candidate for a bugfix-only version. Fixes: - patch #1791576 HTTP auth: support REDIRECT_REMOTE_USER, thanks to Allard + [lang] Serbian update, thanks to Mihailo Stefanovic - bug #1798841 [relations] Copying db does not copy internal relations - bug #1798646 [display] Character '+' in query wrongly interpreted - bug #1801919 [themes] Do not use NaviDatabaseNameColor for fieldset legend - bug #1764735 [core] Designer: PDF error when deleting a table - bug #1764195 [views] DROP button does not work on defective views - bug #1805773 [relations] browse foreign values: return values not escaped, thanks to Alex Rambau - bug #1807923 [login] Login with html entities in password fails - [core] Undefined variable when creating a table that exists - patch #1808578 Changes in font size were no longer detected after patch #1787915 + [lang] Croatian update, thanks to Renato Pavicic - patch #1807615 [GUI] Display patch for column rights in Opera - bug #1811519 Can't delete user with a german umlaut. - bug #1811519 [privileges] fixed used collation for accessing mysql.user in server privileges - it should not be possible to move or copy a table to information_schema - bug #1814733 win: copy db to mixed name db fails - bug #1777249 [display] Remove horizontal lines in navigation panel - bug #1805102 [display] TextareaAutoSelect issues: set this parameter default value to false to help cut&paste from a terminal window; also set focus to the textarea - bug #1814463 [display] Wrong database size - bug #1811527 [display] Problem with links to the MySQL manual - patch #1817529 [auth] Incorrect login via URL when AllowArbitraryServer is true, thanks to Juergen Wind Download from http://www.phpmyadmin.net Marc Delisle, for the team

1 0

[Phpmyadmin-devel] PHP 5.3.0 dev WIN with mysqlnd
by Sebastian Mendel 19 Oct '07

19 Oct '07

Hi, Andrey has sent me a windows cgi build for PHP 5.3.0 dev with mysqlnd mysqlnd is the replacement for mysql lib supporting mysqli and mysql interface if anyone is interested i could send it to him a 5.2.1 win build and the source can be obtained from here: http://dev.mysql.com/downloads/connector/php-mysqlnd/ mysqlnd is going to replace any mysql lib dependency in PHP 5.3 mysqlnd will be cross version compatible -- Sebastian

3 2

[Phpmyadmin-devel] upgrading TCPDF
by Sebastian Mendel 18 Oct '07

18 Oct '07

Hi (Marc), should we upgrade TCPDF to latest PHP 5 version? i am not very familiar with PDF features and do not know what needs to be tested ... -- Sebastian

3 2

[Phpmyadmin-devel] concatenate locales
by Sebastian Mendel 18 Oct '07

18 Oct '07

Hi, $strTable . ' ' . htmlspecialchars($table) . ' ' . $strHasBeenAltered; should become sprintf($strTableAlteredSuccessfully, $table); 'Table %1 has been altered successfully' or? (i know in English it makes no difference, but in other foreign languages it could) for Example in German it sounds better to use 'Die Tabelle' (the table) instead of just 'Tabelle' (table) in this case -- Sebastian

4 22

[Phpmyadmin-devel] phpMyAdmin 2.11.1.2 is released
by Marc Delisle 17 Oct '07

17 Oct '07

Hi, This security announcement (http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6) explains the reasons for releasing 2.11.1.2. Downloads as usual from http://www.phpmyadmin.net Marc Delisle, for the team

1 0

Re: [Phpmyadmin-devel] [Phpmyadmin-svn] SF.net SVN: phpmyadmin: [10816]
by Sebastian Mendel 17 Oct '07

17 Oct '07

Marc Delisle schrieb: > cybot_tm(a)users.sourceforge.net a écrit : >> Revision: 10816 >> http://phpmyadmin.svn.sourceforge.net/phpmyadmin/?rev=10816&view=rev >> Author: cybot_tm >> Date: 2007-10-17 01:03:19 -0700 (Wed, 17 Oct 2007) >> >> Log Message: >> ----------- >> commented out auto-switching to active database - really required? bug #1814718 win: table list disappears (mixed case db names) >> >> Modified Paths: >> -------------- >> trunk/phpMyAdmin/sql.php >> >> Modified: trunk/phpMyAdmin/sql.php >> =================================================================== >> --- trunk/phpMyAdmin/sql.php 2007-10-17 08:02:56 UTC (rev 10815) >> +++ trunk/phpMyAdmin/sql.php 2007-10-17 08:03:19 UTC (rev 10816) >> @@ -341,12 +341,14 @@ >> >> // Checks if the current database has changed >> // This could happen if the user sends a query like "USE `database`;" >> + /* >> $current_db = PMA_DBI_fetch_value('SELECT DATABASE()'); >> if ($db !== $current_db) { >> $db = $current_db; >> $reload = 1; >> } >> unset($current_db); >> + */ >> >> // tmpfile remove after convert encoding appended by Y.Kawada >> if (function_exists('PMA_kanji_file_conv') > > Sebastian, > this code is there to permit a user to type "USE dbname" and it switches > to it. This is useful to open quickly a database, especially if there > are hundreds of them and he has to paginate in the navi panel. ok ... but it does not work ... at least on Win with lower_case_table_names = 2 i have opened a mysql bug report, lets wait what they say ... -- Sebastian

1 0

[Phpmyadmin-devel] phpMyadmin 2.11.1.1 is released
by Marc Delisle 16 Oct '07

16 Oct '07

Hi, This security announcement (http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5) explains the reason for releasing 2.11.1.1. Downloads as usual on http://www.phpmyadmin.net Marc Delisle, for the team

1 0

[Phpmyadmin-devel] Captcha for anonymous edits on wiki
by Michal Čihař 15 Oct '07

15 Oct '07

Hi all so far the captcha has been shown only to anonymous users when they tried to add URL. But the amount of edits inserting random letters is still increasing and I don't see another option than to block this way all anonymous edits. Logged in users are not affected by this change. If you have any strong arguments against this, please share. But I feel that time of three people currently managing spam on wiki is more valuable than being wasted on reverting all these ricroldar, domtrocbor and trgetbovarc changes :-). -- Michal Čihař | http://cihar.com | http://blog.cihar.com

3 2

[Phpmyadmin-devel] sql_auto_increment !?
by Sebastian Mendel 12 Oct '07

12 Oct '07

Hi, sql_auto_increment option from table operations page is not respected anywhere!? -- Sebastian

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

Developers