The branch, master has been updated via ebcfdbdef73254b04ee4f557cba36df87b43b026 (commit) via 4d0a765f06558ec40bee74fab2e396a6abfb7b65 (commit) via d79dc1d237de4c3246745c269376db7b99a9d1cb (commit) from 43202720e8bf301cd37eb5384c2fd1227ef43073 (commit)
- Log ----------------------------------------------------------------- commit ebcfdbdef73254b04ee4f557cba36df87b43b026 Author: Herman van Rink rink@initfour.nl Date: Fri Jul 8 17:26:59 2011 +0200
Added link to advisory for PMASA-2011-[5678]
commit 4d0a765f06558ec40bee74fab2e396a6abfb7b65 Merge: d79dc1d237de4c3246745c269376db7b99a9d1cb 43202720e8bf301cd37eb5384c2fd1227ef43073 Author: Herman van Rink rink@initfour.nl Date: Fri Jul 8 17:19:08 2011 +0200
Merge branch 'master' of ssh://phpmyadmin.git.sourceforge.net/gitroot/phpmyadmin/website
commit d79dc1d237de4c3246745c269376db7b99a9d1cb Author: Marc Delisle marc@infomarc.info Date: Thu Jul 7 15:09:36 2011 -0400
New advisories
-----------------------------------------------------------------------
Summary of changes: templates/security/{PMASA-2011-8 => PMASA-2011-10} | 28 ++++++++---------- templates/security/PMASA-2011-5 | 3 +- templates/security/PMASA-2011-6 | 3 +- templates/security/PMASA-2011-7 | 3 +- templates/security/PMASA-2011-8 | 3 +- templates/security/{PMASA-2011-3 => PMASA-2011-9} | 30 ++++++++------------ 6 files changed, 32 insertions(+), 38 deletions(-) copy templates/security/{PMASA-2011-8 => PMASA-2011-10} (58%) copy templates/security/{PMASA-2011-3 => PMASA-2011-9} (52%)
diff --git a/templates/security/PMASA-2011-8 b/templates/security/PMASA-2011-10 similarity index 58% copy from templates/security/PMASA-2011-8 copy to templates/security/PMASA-2011-10 index 7bd14a0..77c3148 100644 --- a/templates/security/PMASA-2011-8 +++ b/templates/security/PMASA-2011-10 @@ -3,53 +3,49 @@
<py:def function="announcement_id"> -PMASA-2011-8 +PMASA-2011-10 </py:def>
<py:def function="announcement_date"> -2011-07-02 +2011-07-XX </py:def>
<py:def function="announcement_summary"> -Possible directory traversal. +Local file inclusion. </py:def>
<py:def function="announcement_description"> -Fixed filtering of a file path in the MIME-type transformation code, which allowed for directory traversal. +Via a crafted MIME-type transformation parameter, an attacker can perform a local file inclusion. </py:def>
<py:def function="announcement_severity"> We consider this vulnerability to be serious. </py:def>
-<py:def function="announcement_affected"> -The 3.4.3 and earlier versions are affected. +<py:def function="announcement_mitigation"> +The phpMyAdmin's configuration storage mechanism must be configured for this attack to work. </py:def>
-<py:def function="announcement_unaffected"> -Branch 2.11.x is not affected by this. +<py:def function="announcement_affected"> +Versions 3.4.0 to 3.4.3.1 are affected. </py:def>
<py:def function="announcement_solution"> -Upgrade to phpMyAdmin 3.3.10.2 or 3.4.3.1 or apply the related patch listed below. +Upgrade to phpMyAdmin 3.4.3.2 or apply the related patch listed below. </py:def>
<!--! Links to reporter etc, do not forget to escape & to & --> <py:def function="announcement_references"> -This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a> +This issue was found by Norman Hippert from <a href="http://www.the-wildcat.de/">The-Wildcat.de</a> </py:def>
<!--! CVE ID of the report, this is automatically added to references --> -<py:def function="announcement_cve">CVE-2011-2508</py:def> +<py:def function="announcement_cve">CVE-2011-XXXX</py:def>
<py:def function="announcement_cwe">661 98</py:def>
<py:def function="announcement_commits"> -b434320eff8ca9c2fc1b043c1804f868341af9a7 -</py:def> - -<py:def function="announcement_commits_3_3"> -5ee357a572866e730d83f56d6187a67c7c48e523 +f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c </py:def>
<xi:include href="_page.tpl" /> diff --git a/templates/security/PMASA-2011-5 b/templates/security/PMASA-2011-5 index b21c291..5cea3f8 100644 --- a/templates/security/PMASA-2011-5 +++ b/templates/security/PMASA-2011-5 @@ -41,7 +41,8 @@ Upgrade to phpMyAdmin 3.3.10.2 or 3.4.3.1 or apply the related patch listed belo
<!--! Links to reporter etc, do not forget to escape & to & --> <py:def function="announcement_references"> -This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a> +This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a>. +<a href="http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt">His advisory.</a> </py:def>
<!--! CVE ID of the report, this is automatically added to references --> diff --git a/templates/security/PMASA-2011-6 b/templates/security/PMASA-2011-6 index c06ba98..9d3d839 100644 --- a/templates/security/PMASA-2011-6 +++ b/templates/security/PMASA-2011-6 @@ -38,7 +38,8 @@ Upgrade to phpMyAdmin 3.3.10.2 or 3.4.3.1 or apply the related patch listed belo
<!--! Links to reporter etc, do not forget to escape & to & --> <py:def function="announcement_references"> -This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a> +This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a>. +<a href="http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt">His advisory.</a> </py:def>
<!--! CVE ID of the report, this is automatically added to references --> diff --git a/templates/security/PMASA-2011-7 b/templates/security/PMASA-2011-7 index a33048c..2bc9039 100644 --- a/templates/security/PMASA-2011-7 +++ b/templates/security/PMASA-2011-7 @@ -48,7 +48,8 @@ Upgrade to phpMyAdmin 3.3.10.2 or 3.4.3.1 or apply the related patch listed belo
<!--! Links to reporter etc, do not forget to escape & to & --> <py:def function="announcement_references"> -This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a> +This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a>. +<a href="http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt">His advisory.</a> </py:def>
<!--! CVE ID of the report, this is automatically added to references --> diff --git a/templates/security/PMASA-2011-8 b/templates/security/PMASA-2011-8 index 7bd14a0..d871607 100644 --- a/templates/security/PMASA-2011-8 +++ b/templates/security/PMASA-2011-8 @@ -36,7 +36,8 @@ Upgrade to phpMyAdmin 3.3.10.2 or 3.4.3.1 or apply the related patch listed belo
<!--! Links to reporter etc, do not forget to escape & to & --> <py:def function="announcement_references"> -This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a> +This issue was found by Frans Pehrson from <a href="http://www.xxor.se">Xxor AB</a>. +<a href="http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt">His advisory.</a> </py:def>
<!--! CVE ID of the report, this is automatically added to references --> diff --git a/templates/security/PMASA-2011-3 b/templates/security/PMASA-2011-9 similarity index 52% copy from templates/security/PMASA-2011-3 copy to templates/security/PMASA-2011-9 index d48bad0..e34d305 100644 --- a/templates/security/PMASA-2011-3 +++ b/templates/security/PMASA-2011-9 @@ -3,57 +3,51 @@
<py:def function="announcement_id"> -PMASA-2011-3 +PMASA-2011-9 </py:def>
<py:def function="announcement_date"> -2011-05-22 +2011-07-XX </py:def>
<py:def function="announcement_summary"> -XSS vulnerability on Tracking page. +XSS in table Print view. </py:def>
<py:def function="announcement_description"> -It was possible to create a crafted table name that leads to XSS. +The attacker must trick the victim into clicking a link that reaches phpMyAdmin's table print view script; one of the link's parameters is a crafted table name (the name containing Javascript code). </py:def>
<py:def function="announcement_severity"> -We consider this vulnerability to be serious. +We consider this vulnerability to be minor. </py:def>
<py:def function="announcement_mitigation"> -This vulnerability works in the context of a shared phpMyAdmin installation. -The attacker needs to convince a victim to go to the Tracking page that -relates to the crafted table. +The crafted table name must exist (the attacker must have access to create a table on the victim's server). </py:def>
<py:def function="announcement_affected"> -The 3.3.x and 3.4.0 versions are affected. +The 3.4.3.1 and earlier versions are affected. </py:def>
<py:def function="announcement_solution"> -Upgrade to phpMyAdmin 3.3.10.1 or 3.4.1 or apply the related patch listed below. +Upgrade to phpMyAdmin 3.4.3.2 or apply the related patch listed below. </py:def>
<!--! Links to reporter etc, do not forget to escape & to & --> <py:def function="announcement_references"> -This issue was found by a person who wishes to be known as "dave b". +This issue was found by Norman Hippert from <a href="http://www.the-wildcat.de/">The-Wildcat.de</a> </py:def>
<!--! CVE ID of the report, this is automatically added to references --> -<py:def function="announcement_cve">CVE-2011-1940</py:def> +<py:def function="announcement_cve">CVE-2011-XXXX</py:def>
<py:def function="announcement_cwe">661 79</py:def>
<py:def function="announcement_commits"> -7e10c132a3887c8ebfd7a8eee356b28375f1e287 -d3ccf798fdbd4f8a89d4088130637d8dee918492 -</py:def> +a0823be05aa5835f207c0838b9cca67d2d9a050a +4bd27166c314faa37cada91533b86377f4d4d214
-<py:def function="announcement_commits_3_3_10"> -1300510d3686b40adefafb7f1778a6f06d0a553a -452669a1746898a08129d3a555ac4b1ec084b423 </py:def>
<xi:include href="_page.tpl" />
hooks/post-receive