[Phpmyadmin-git] [SCM] phpMyAdmin website branch, master, updated. 3e5318d5ead79e3b8b2b2766eb35d3c12d234516

17 Oct 2011

The branch, master has been updated
       via  3e5318d5ead79e3b8b2b2766eb35d3c12d234516 (commit)
       via  f3ba4f29b6866e18c70745e29191449ffb8c8caa (commit)
       via  039745a4eefff8e6b0a9b5e7f2267c1015be1357 (commit)
       via  5841f49c6156965f5906109f2bc7d34c475e531a (commit)
       via  0bebbc9d522de74125847550db6df16f906b2216 (commit)
       via  70018cc6d9658a99f405e4eaddfa706291faa00f (commit)
       via  e6e233111a4b3e378dd5473606519e4fb3c67ed9 (commit)
       via  447d7d3f80f9c02bde2d961d06c2ea49d876009f (commit)
       via  77635f8324f780f5ae50942d018c3e2677d3841f (commit)
       via  58df2271126e48b0d142f4dfd2cc7a72fbe3723d (commit)
      from  7f414583ea794a214668c4b4cec8ce374721913d (commit)


- Log -----------------------------------------------------------------
commit 3e5318d5ead79e3b8b2b2766eb35d3c12d234516
Author: Marc Delisle <marc@infomarc.info>
Date:   Mon Oct 17 05:29:15 2011 -0400

    Cosmetic fix

commit f3ba4f29b6866e18c70745e29191449ffb8c8caa
Author: Marc Delisle <marc@infomarc.info>
Date:   Mon Oct 17 05:24:31 2011 -0400

    Release date

commit 039745a4eefff8e6b0a9b5e7f2267c1015be1357
Merge: 5841f49 7f41458
Author: Marc Delisle <marc@infomarc.info>
Date:   Sun Oct 16 17:54:25 2011 -0400

    Merge remote branch 'origin/master' into website-security

commit 5841f49c6156965f5906109f2bc7d34c475e531a
Merge: 0bebbc9 83880d0
Author: Marc Delisle <marc@infomarc.info>
Date:   Sun Oct 16 17:47:46 2011 -0400

    Merge remote branch 'origin/master' into website-security

commit 0bebbc9d522de74125847550db6df16f906b2216
Author: Marc Delisle <marc@infomarc.info>
Date:   Sun Oct 16 17:45:18 2011 -0400

    Fix syntax error

commit 70018cc6d9658a99f405e4eaddfa706291faa00f
Author: Marc Delisle <marc@infomarc.info>
Date:   Sun Oct 16 16:50:02 2011 -0400

    Web ref from the reporter

commit e6e233111a4b3e378dd5473606519e4fb3c67ed9
Author: Dieter Adriaenssens <ruleant@users.sourceforge.net>
Date:   Sun Oct 16 16:10:39 2011 +0200

    added CVE ID to PMASA-2011-16

commit 447d7d3f80f9c02bde2d961d06c2ea49d876009f
Author: Marc Delisle <marc@infomarc.info>
Date:   Fri Oct 14 07:31:11 2011 -0400

    PMASA-2011-16

commit 77635f8324f780f5ae50942d018c3e2677d3841f
Author: Dieter Adriaenssens <ruleant@users.sourceforge.net>
Date:   Mon Oct 3 21:02:53 2011 +0200

    update PMASA-2011-15 with commit hashes + better wording

commit 58df2271126e48b0d142f4dfd2cc7a72fbe3723d
Author: Dieter Adriaenssens <ruleant@users.sourceforge.net>
Date:   Fri Sep 23 21:49:52 2011 +0200

    PMASA-2011-15 proposal

-----------------------------------------------------------------------

Summary of changes:
 templates/security/{PMASA-2011-1 => PMASA-2011-15} |   34 +++++-------
 templates/security/PMASA-2011-16                   |   53 ++++++++++++++++++++
 2 files changed, 67 insertions(+), 20 deletions(-)
 copy templates/security/{PMASA-2011-1 => PMASA-2011-15} (50%)
 create mode 100644 templates/security/PMASA-2011-16

diff --git a/templates/security/PMASA-2011-1 b/templates/security/PMASA-2011-15
similarity index 50%
copy from templates/security/PMASA-2011-1
copy to templates/security/PMASA-2011-15
index 0350dd5..da80227 100644
--- a/templates/security/PMASA-2011-1
+++ b/templates/security/PMASA-2011-15
@@ -1,21 +1,21 @@
 <html xmlns:py="http://genshi.edgewall.org/" xmlns:xi="http://www.w3.org/2001/XInclude" py:strip="">
 
 <py:def function="announcement_id">
-PMASA-2011-1
+PMASA-2011-15
 </py:def>
 
 <py:def function="announcement_date">
-2011-02-08
+2011-10-17
 </py:def>
 
 <py:def function="announcement_summary">
-Path disclosure when some files have been removed.
+Path disclosure due to insufficient url parameter validation.
 </py:def>
 
 <py:def function="announcement_description">
-When the files README, ChangeLog or LICENSE have been removed from their
-original place (possibly by the distributor), the scripts used to display
-these files can show their full path, leading to possible further attacks.
+When the js_frame parameter of phpmyadmin.css.php is defined as an array,
+an error message shows the full path of this file,
+leading to possible further attacks.
 </py:def>
 
 <py:def function="announcement_mitigation">
@@ -29,33 +29,27 @@ We consider this vulnerability to be non critical.
 </py:def>
 
 <py:def function="announcement_affected">
-The 2.11.x and 3.3.x versions are affected.
+Versions 3.4.x are affected.
 </py:def>
 
 <py:def function="announcement_solution">
-Upgrade to phpMyAdmin 3.3.9.1 or newer (2.11.11.2 or newer for the older
-family) or apply the related patch listed below.
+Upgrade to phpMyAdmin 3.4.6 or newer or apply the related patch listed below.
 </py:def>
 
 <py:def function="announcement_references">
-Thanks to MustLive from <a href="http://websecurity.com.ua">Websecurity</a>
- for reporting this issue.
+Thanks to <a href="http://securitate.md/">Mihail Ursu</a> for reporting this issue.
 </py:def>
 
-<py:def function="announcement_cve">CVE-2011-0986</py:def>
+<py:def function="announcement_cve">CVE-2011-3646</py:def>
 
-<py:def function="announcement_cwe">661 200</py:def>
+<py:def function="announcement_cwe">20 200</py:def>
 
 <py:def function="announcement_commits">
-035d002db1e1201e73e560d7d98591563b506a83
+d35cba980893aa6e6455fd6e6f14f3e3f1204c52
 </py:def>
 
-<py:def function="announcement_commits_3_3">
-4c8c7080a76b837ae55cdc5e010c793b389a671a
-</py:def>
-
-<py:def function="announcement_commits_2_11">
-f0e8849034132e2114f1d77d9d37185bc5b49886
+<py:def function="announcement_commits_3_4">
+e05b37d3c9e5b99e8a779fe55780d92df17b4a55
 </py:def>
 
 <xi:include href="_page.tpl" />
diff --git a/templates/security/PMASA-2011-16 b/templates/security/PMASA-2011-16
new file mode 100644
index 0000000..d82b828
--- /dev/null
+++ b/templates/security/PMASA-2011-16
@@ -0,0 +1,53 @@
+<html xmlns:py="http://genshi.edgewall.org/" xmlns:xi="http://www.w3.org/2001/XInclude" py:strip="">
+
+<py:def function="announcement_id">
+PMASA-2011-16
+</py:def>
+
+<py:def function="announcement_date">
+2011-10-17
+</py:def>
+
+<py:def function="announcement_summary">
+XSS in setup.
+</py:def>
+
+<py:def function="announcement_description">
+Crafted values entered in the setup interface can produce XSS; also, if the
+config directory exists and is writeable, the XSS payload can be saved
+to this directory.
+</py:def>
+
+<py:def function="announcement_mitigation">
+The documentation warns against leaving this directory writeable; also
+a warning appears on the home page. Also, this XSS would target only the
+users who visit /setup.
+</py:def>
+
+<py:def function="announcement_severity">
+We consider this vulnerability to be non critical.
+</py:def>
+
+<py:def function="announcement_affected">
+Versions 3.4.x are affected.
+</py:def>
+
+<py:def function="announcement_solution">
+Upgrade to phpMyAdmin 3.4.6 or newer or apply the related patch listed below.
+</py:def>
+
+<py:def function="announcement_references">
+Thanks to Jakub Gałczyk (<a href="http://hauntit.blogspot.com">http://hauntit.blogspot.com</a>) for reporting this issue.
+</py:def>
+
+<py:def function="announcement_cve">CVE-2011-4064</py:def>
+
+<py:def function="announcement_cwe">661 79</py:def>
+
+<py:def function="announcement_commits_3_4">
+ca597dc423f3eebcca95ff33b088a03e39109115
+1af420e22367ae72ff4091adb1620e59ddad5ba6
+</py:def>
+
+<xi:include href="_page.tpl" />
+</html>


hooks/post-receive
-- 
phpMyAdmin website

    

Marc Delisle

tags

participants (1)