phpmyadmin: CVE-2006-1803/CVE-2006-1804 "sql_query" Cross-Site Scripting and SQL Code Execution

Debian Bug report logs - #363519
phpmyadmin: CVE-2006-1803/CVE-2006-1804 "sql_query" Cross-Site Scripting and SQL Code Execution

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: phpmyadmin: CVE-2006-1803/CVE-2006-1804 "sql_query" Cross-Site Scripting and SQL Code Execution

Date: Wed, 19 Apr 2006 17:14:55 +0200

Package: phpmyadmin
Severity: important
Tags: security

CVE-2006-1803:
Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin
2.7.0-pl1 allows remote attackers to inject arbitrary web script or
HTML via the sql_query parameter.

CVE-2006-1804 seems to be a duplicate of this.

http://www.frsirt.com/english/advisories/2006/1372 implies that
this also affects 2.8.0.3

Message #12 received at 363519-close@bugs.debian.org (full text, mbox, reply):

From: Piotr Roszatycki <dexter@debian.org>

To: 363519-close@bugs.debian.org

Subject: Bug#363519: fixed in phpmyadmin 4:2.8.1-1

Date: Mon, 26 Jun 2006 04:47:05 -0700

Source: phpmyadmin
Source-Version: 4:2.8.1-1

We believe that the bug you reported is fixed in the latest version of
phpmyadmin, which is due to be installed in the Debian FTP archive:

phpmyadmin_2.8.1-1.diff.gz
  to pool/main/p/phpmyadmin/phpmyadmin_2.8.1-1.diff.gz
phpmyadmin_2.8.1-1.dsc
  to pool/main/p/phpmyadmin/phpmyadmin_2.8.1-1.dsc
phpmyadmin_2.8.1-1_all.deb
  to pool/main/p/phpmyadmin/phpmyadmin_2.8.1-1_all.deb
phpmyadmin_2.8.1.orig.tar.gz
  to pool/main/p/phpmyadmin/phpmyadmin_2.8.1.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 363519@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Piotr Roszatycki <dexter@debian.org> (supplier of updated phpmyadmin package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun, 25 Jun 2006 18:10:23 +0200
Source: phpmyadmin
Binary: phpmyadmin
Architecture: source all
Version: 4:2.8.1-1
Distribution: unstable
Urgency: medium
Maintainer: Piotr Roszatycki <dexter@debian.org>
Changed-By: Piotr Roszatycki <dexter@debian.org>
Description: 
 phpmyadmin - set of PHP-scripts to administrate MySQL over the WWW
Closes: 362154 363519 363597 364702 367146 368082 373204
Changes: 
 phpmyadmin (4:2.8.1-1) unstable; urgency=medium
 .
   * New upstream release. Closes: #373204.
     - The French translation is correct. Closes: #362154.
     - Generates correct dumps with UPDATE syntax. Closes: #364702.
   * Security fix: XSRF vulnerability.
     See: http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3
     See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1804
   * Security fix: XSS vulnerabilities. It was not a problem for Debian with
     the default settings.
     See: http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2
     See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2031
     Closes: #363519, #368082.
   * Updated Portuguese debconf templates translation, thanks Miguel Figueiredo.
     Closes: #363597.
   * Updated Russian debconf templates translation, thanks Yuriy Talakan.
     Closes: #367146.
   * Convert non-ISO-8859-1 debconf templates translation to UTF-8.
Files: 
 dfe2c86bc5a1be2aee401c84ec3a4282 634 web extra phpmyadmin_2.8.1-1.dsc
 18104bccba01ff6618ed22a710019edf 3455447 web extra phpmyadmin_2.8.1.orig.tar.gz
 da8c395e567ff78e77eac80d0b3c755d 38949 web extra phpmyadmin_2.8.1-1.diff.gz
 4d6c6753a3a1d3906de7598a168e1ab2 3627512 web extra phpmyadmin_2.8.1-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEn6fghMHHe8CxClsRAoSLAJ9enUFWHp2wyp2wPPRlhd8n1rSLNQCgpZQQ
6niAqcbAjZL+Ri9di7AJo7s=
=LYX/
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.