U radu programskog paketa phpMyAdmin, distribuiranog s operacijskim sustavima Fedora 13 i 14, uočene su sigurnosne ranjivosti. PhpMyAdmin je programski paket za administriranje MySQL baza podataka putem web sučelja. Sigurnosne ranjivosti su vezane uz skripte "error.php" i "phpinfo.php". Udaljenom napadaču omogućuju XSS (eng. cross-site scripting) napad, putem "BBcode" oznake koja sadrži znak "@", te zaobilaženje autentikacije i uvid u povjerljive podatke. Svim korisnicima navedenog programskog paketa savjetuje se njegova nadogradnja.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-3737
2011-03-21 20:27:08
--------------------------------------------------------------------------------
Name : phpMyAdmin
Product : Fedora 14
Version : 3.3.10
Release : 1.fc14
URL : http://www.phpmyadmin.net/
Summary : Web based MySQL browser written in php
Description :
phpMyAdmin is a tool written in PHP intended to handle the administration of
MySQL over the Web. Currently it can create and drop databases,
create/drop/alter tables, delete/edit/add fields, execute any SQL statement,
manage keys on fields, manage privileges, export data into various formats and
is available in over 55 languages.
--------------------------------------------------------------------------------
Update Information:
Changes for 3.3.10.0 (2011-03-19)
- [structure] Aria table size printed as unknown, thanks to erickoh75 -
erickoh75
- [structure] Ordering by size gives incorrect results, thanks to Madhura
Jayaratne - madhuracj
- [core] 0 row(s) affected
- [core] Edit relational page and page number
- [security] Minor security fixes, see PMASA-2010-9 and PMASA-2010-10
- [lang] German update, thanks to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite..
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 21 2011 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.10-1
- Upstream released 3.3.10 (#661335, #662366, #662367, #689213)
* Sun Feb 13 2011 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.9.2-1
- Upstream released 3.3.9.2 (#676172)
* Thu Feb 10 2011 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.9.1-1
- Upstream released 3.3.9.1 (#676172)
* Wed Feb 9 2011 Fedora Release Engineering <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.>
- 3.3.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
* Mon Jan 3 2011 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.9-1
- Upstream released 3.3.9 (#666925)
* Mon Nov 29 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.8.1-1
- Upstream released 3.3.8.1
* Fri Oct 29 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.8-1
- Upstream released 3.3.8 (#631748)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #661335 - CVE-2010-4480 phpMyAdmin: XSS vulnerability via crafted
BBCode tag in error.php
https://bugzilla.redhat.com/show_bug.cgi?id=661335
[ 2 ] Bug #662366 - CVE-2010-4481 phpMyAdmin: information disclosure flaw
(PMASA-2010-10)
https://bugzilla.redhat.com/show_bug.cgi?id=662366
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update phpMyAdmin' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-3733
2011-03-21 20:24:58
--------------------------------------------------------------------------------
Name : phpMyAdmin
Product : Fedora 13
Version : 3.3.10
Release : 1.fc13
URL : http://www.phpmyadmin.net/
Summary : Web based MySQL browser written in php
Description :
phpMyAdmin is a tool written in PHP intended to handle the administration of
MySQL over the Web. Currently it can create and drop databases,
create/drop/alter tables, delete/edit/add fields, execute any SQL statement,
manage keys on fields, manage privileges, export data into various formats and
is available in over 55 languages.
--------------------------------------------------------------------------------
Update Information:
Changes for 3.3.10.0 (2011-03-19)
- [structure] Aria table size printed as unknown, thanks to erickoh75 -
erickoh75
- [structure] Ordering by size gives incorrect results, thanks to Madhura
Jayaratne - madhuracj
- [core] 0 row(s) affected
- [core] Edit relational page and page number
- [security] Minor security fixes, see PMASA-2010-9 and PMASA-2010-10
- [lang] German update, thanks to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite..
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 21 2011 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.10-1
- Upstream released 3.3.10 (#661335, #662366, #662367, #689213)
* Sun Feb 13 2011 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.9.2-1
- Upstream released 3.3.9.2 (#676172)
* Thu Feb 10 2011 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.9.1-1
- Upstream released 3.3.9.1 (#676172)
* Wed Feb 9 2011 Fedora Release Engineering <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.>
- 3.3.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
* Mon Jan 3 2011 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.9-1
- Upstream released 3.3.9 (#666925)
* Mon Nov 29 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.8.1-1
- Upstream released 3.3.8.1
* Fri Oct 29 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.8-1
- Upstream released 3.3.8 (#631748)
* Wed Sep 8 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.7-1
- Upstream released 3.3.7 (#631824, #631829)
* Sun Aug 29 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.6-1
- Upstream released 3.3.6 (#628301)
* Fri Aug 20 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.5.1-1
- Upstream released 3.3.5.1 (#625877, #625878)
- Added patch to fix wrong variable check at nopassword (#622428)
* Tue Jul 27 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.5-1
- Upstream released 3.3.5 (#618586)
* Tue Jun 29 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.4-1
- Upstream released 3.3.4 (#609057)
* Sat Jun 26 2010 Robert Scheck <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> 3.3.3-1
- Upstream released 3.3.3 (#558322, #589288, #589487)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #661335 - CVE-2010-4480 phpMyAdmin: XSS vulnerability via crafted
BBCode tag in error.php
https://bugzilla.redhat.com/show_bug.cgi?id=661335
[ 2 ] Bug #662366 - CVE-2010-4481 phpMyAdmin: information disclosure flaw
(PMASA-2010-10)
https://bugzilla.redhat.com/show_bug.cgi?id=662366
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update phpMyAdmin' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke