This update of phpMyAdmin fixes a cross-site-scripting vulnerability.
(CVE-2007-6100,CVE-2007-5589)

The login page (auth_type cookie) was vulnerable to XSS via the convcharset parameter (PMASA-2007-8).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The DigiTrust Group discovered serious XSS vulnerability in the phpMyAdmin server_status.php script. According to their report

vulnerability can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

- Mon Oct 29 2007 Mike McGrath <mmcgrath at redhat.com>     2.11.2-1

    - upstream released new version

    - Mon Oct 22 2007 Mike McGrath <mmcgrath at redhat.com>       2.11.1.2-1

    - upstream released new version

    - Thu Sep 6 2007 Mike McGrath <mmcgrath at redhat.com>       2.11.0-1

    - Upstream released new version

    - Altered sources file as required

    - Added proper license

    - Mon Jul 23 2007 Mike McGrath <mmcgrath at redhat.com>       2.10.3-1

    - Upstream released new version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Omer Singer of the DigiTrust Group discovered several vulnerabilities in phpMyAdmin, an application to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5589     phpMyAdmin allows a remote attacker to inject arbitrary     web script or HTML in the context of a logged in user's     session (cross site scripting).

  - CVE-2007-5386     phpMyAdmin, when accessed by a browser that does not     URL-encode requests, allows remote attackers to inject     arbitrary web script or HTML via the query string.

ID	名稱	產品	系列	已發布	已更新	嚴重性
31455	openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-5083)	Nessus	SuSE Local Security Checks	2008/3/13	2021/1/14	medium
31456	openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-5084)	Nessus	SuSE Local Security Checks	2008/3/13	2021/1/14	medium
28311	Fedora 7 : phpMyAdmin-2.11.2.2-1.fc7 (2007-3666)	Nessus	Fedora Local Security Checks	2007/11/26	2021/1/11	medium
28310	Fedora 8 : phpMyAdmin-2.11.2.2-1.fc8 (2007-3639)	Nessus	Fedora Local Security Checks	2007/11/26	2021/1/11	medium
27508	FreeBSD : phpmyadmin -- XSS vulnerability (498a8731-7cfc-11dc-96e6-0012f06707f0)	Nessus	FreeBSD Local Security Checks	2007/10/18	2021/1/6	medium
27800	Fedora 7 : phpMyAdmin-2.11.2-1.fc7 (2007-2738)	Nessus	Fedora Local Security Checks	2007/11/6	2021/1/11	medium
27842	Debian DSA-1403-1 : phpmyadmin - missing input sanitising	Nessus	Debian Local Security Checks	2007/11/9	2021/1/4	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium