CVE-2005-3301: Cross-Site Scripting vulnerability.

Debian Bug report logs - #335513
CVE-2005-3301: Cross-Site Scripting vulnerability.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Florian Weimer <fw@deneb.enyo.de>

To: submit@bugs.debian.org

Subject: CVE-2005-3301: XSS in left.php, queryframe.php, server_databases.php

Date: Mon, 24 Oct 2005 14:15:33 +0200

Package: phpmyadmin
Version: 4:2.6.4-pl2-1
Severity: important
Tags: security

See upstreams announcement PMASA-2005-5:
<http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5>

This set of issues is being tracked as CVE-2005-3301.  Please mention
this name in the changelog when uploading a fixed package.

Message #10 received at 335513-close@bugs.debian.org (full text, mbox, reply):

From: Piotr Roszatycki <dexter@debian.org>

To: 335513-close@bugs.debian.org

Subject: Bug#335513: fixed in phpmyadmin 4:2.6.4-pl3-1

Date: Mon, 24 Oct 2005 13:32:59 -0700

Source: phpmyadmin
Source-Version: 4:2.6.4-pl3-1

We believe that the bug you reported is fixed in the latest version of
phpmyadmin, which is due to be installed in the Debian FTP archive:

phpmyadmin_2.6.4-pl3-1.diff.gz
  to pool/main/p/phpmyadmin/phpmyadmin_2.6.4-pl3-1.diff.gz
phpmyadmin_2.6.4-pl3-1.dsc
  to pool/main/p/phpmyadmin/phpmyadmin_2.6.4-pl3-1.dsc
phpmyadmin_2.6.4-pl3-1_all.deb
  to pool/main/p/phpmyadmin/phpmyadmin_2.6.4-pl3-1_all.deb
phpmyadmin_2.6.4-pl3.orig.tar.gz
  to pool/main/p/phpmyadmin/phpmyadmin_2.6.4-pl3.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 335513@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Piotr Roszatycki <dexter@debian.org> (supplier of updated phpmyadmin package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 24 Oct 2005 20:14:08 +0200
Source: phpmyadmin
Binary: phpmyadmin
Architecture: source all
Version: 4:2.6.4-pl3-1
Distribution: unstable
Urgency: high
Maintainer: Piotr Roszatycki <dexter@debian.org>
Changed-By: Piotr Roszatycki <dexter@debian.org>
Description: 
 phpmyadmin - set of PHP-scripts to administrate MySQL over the WWW
Closes: 335306 335513
Changes: 
 phpmyadmin (4:2.6.4-pl3-1) unstable; urgency=high
 .
   * New upstream release.
   * Security fix: (1) Local file inclusion vulnerability and (2) Cross-Site
     Scripting vulnerability.
     See http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3300
     See http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3301
     Closes: #335306, #335513.
   * Assigned CVE number for 4:2.6.4-pl2-1 bug fix.
Files: 
 b76157341450a63bbcbbbfa833f0e970 646 web extra phpmyadmin_2.6.4-pl3-1.dsc
 69cc488cb259a5b6f2bd83c95d1b94d2 2777834 web extra phpmyadmin_2.6.4-pl3.orig.tar.gz
 9fcb9225e9ee4a0fe67960deef9366dd 30725 web extra phpmyadmin_2.6.4-pl3-1.diff.gz
 3a0d95dba07006c4f6d89b0365bd6367 2923084 web extra phpmyadmin_2.6.4-pl3-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDXSrfhMHHe8CxClsRAudZAJ472YLaoGzJ9sT5pd787J4wutUfWQCg0SbX
jjJYiOWdfPwgoRzFV9hDOo0=
=m/Yg
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.