[ MDVSA-2009:115 ] phpMyAdmin

[dude67]

_______________________________________________________________________

Package : phpMyAdmin
Date : May 18, 2009
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been identified and corrected in
phpMyAdmin:

Multiple cross-site scripting (XSS) vulnerabilities in the export page
(display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x
before 3.1.3.1 allow remote attackers to inject arbitrary web script
or HTML via the pma_db_filename_template cookie (CVE-2009-1150).

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x
before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to
inject arbitrary PHP code into a configuration file via the save action
(CVE-2009-1151).

This update provides phpMyAdmin 2.11.9.5, which is not vulnerable to
these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1150
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1151
http://www.phpmyadmin.net/home_page/sec ... 2009-2.php
http://www.phpmyadmin.net/home_page/sec ... 2009-3.php
_______________________________________________________________________