blob: fa354b5e575cf0ec4f168dd66435bcbce9c4e836 [file] [log] [blame]
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201201-01">
<title>phpMyAdmin: Multiple vulnerabilities</title>
<synopsis>Multiple vulnerabilities were found in phpMyAdmin, the most severe
of which allows the execution of arbitrary PHP code.
</synopsis>
<product type="ebuild">phpMyAdmin</product>
<announced>January 04, 2012</announced>
<revised>January 04, 2012: 1</revised>
<bug>302745</bug>
<bug>335490</bug>
<bug>336462</bug>
<bug>354227</bug>
<bug>373951</bug>
<bug>376369</bug>
<bug>387413</bug>
<bug>389427</bug>
<bug>395715</bug>
<access>remote</access>
<affected>
<package name="dev-db/phpmyadmin" auto="yes" arch="*">
<unaffected range="ge">3.4.9</unaffected>
<vulnerable range="lt">3.4.9</vulnerable>
</package>
</affected>
<background>
<p>phpMyAdmin is a web-based management tool for MySQL databases. </p>
</background>
<description>
<p>Multiple vulnerabilities have been discovered in phpMyAdmin. Please
review the CVE identifiers and phpMyAdmin Security Advisories referenced
below for details.
</p>
</description>
<impact type="high">
<p>Remote attackers might be able to insert and execute PHP code, include
and execute local PHP files, or perform Cross-Site Scripting (XSS)
attacks via various vectors.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All phpMyAdmin users should upgrade to the latest version:</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=dev-db/phpmyadmin-3.4.9"
</code>
</resolution>
<references>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-7251">CVE-2008-7251</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-7252">CVE-2008-7252</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2958">CVE-2010-2958</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3055">CVE-2010-3055</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3056">CVE-2010-3056</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3263">CVE-2010-3263</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0986">CVE-2011-0986</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0987">CVE-2011-0987</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2505">CVE-2011-2505</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2506">CVE-2011-2506</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2507">CVE-2011-2507</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2508">CVE-2011-2508</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2642">CVE-2011-2642</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2643">CVE-2011-2643</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2718">CVE-2011-2718</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2719">CVE-2011-2719</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3646">CVE-2011-3646</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4064">CVE-2011-4064</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4107">CVE-2011-4107</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4634">CVE-2011-4634</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4780">CVE-2011-4780</uri>
<uri link="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4782">CVE-2011-4782</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2010-1.php">
PMASA-2010-1
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2010-2.php">
PMASA-2010-2
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php">
PMASA-2010-4
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php">
PMASA-2010-5
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php">
PMASA-2010-6
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php">
PMASA-2010-7
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php">
PMASA-2011-1
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php">
PMASA-2011-10
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php">
PMASA-2011-11
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php">
PMASA-2011-12
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-15.php">
PMASA-2011-15
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-16.php">
PMASA-2011-16
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php">
PMASA-2011-17
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php">
PMASA-2011-18
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php">
PMASA-2011-19
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php">
PMASA-2011-2
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php">
PMASA-2011-20
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php">
PMASA-2011-5
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php">
PMASA-2011-6
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php">
PMASA-2011-7
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php">
PMASA-2011-8
</uri>
<uri link="http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php">
PMASA-2011-9
</uri>
</references>
<metadata timestamp="Fri, 07 Oct 2011 23:38:11 +0000" tag="requester">
underling
</metadata>
<metadata timestamp="Wed, 04 Jan 2012 23:40:25 +0000" tag="submitter">
underling
</metadata>
</glsa>