[ MDVSA-2009:026 ] phpMyAdmin

[dude67]

Cross-site scripting (XSS) vulnerability in pmd_pdf.php allows
remote attackers to inject arbitrary web script or HTML by
using db script parameter when register_global php parameter is
enabled (CVE-2008-4775).

Cross-site request forgery (CSRF) vulnerability in tbl_structure.php
allows remote attackers perform SQL injection and execute arbitrary
code by using table script parameter (CVE-2008-5621).

Multiple cross-site request forgery (CSRF) vulnerabilities in allows
remote attackers perform SQL injection by using unknown vectors
related to table script parameter (CVE-2008-5622).

This update provide the fix for these security issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-4775
http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-5621
http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-5622
_______________________________________________________________________