blob: 7176a14b122a29698b6930fc7b25a3b0bc443c51 [file] [log] [blame]
<?xml version="1.0" encoding="UTF-8"?>
<glsa id="201311-02">
<title>phpMyAdmin: Multiple vulnerabilities</title>
<synopsis>Multiple vulnerabilities have been found in phpMyAdmin, allowing
remote authenticated attackers to execute arbitrary code, inject SQL code
or conduct other attacks.
<product type="ebuild">phpmyadmin</product>
<announced>November 04, 2013</announced>
<revised>November 04, 2013: 1</revised>
<package name="dev-db/phpmyadmin" auto="yes" arch="*">
<unaffected range="ge">4.0.5</unaffected>
<vulnerable range="lt">4.0.5</vulnerable>
<p>phpMyAdmin is a web-based management tool for MySQL databases.</p>
<p>Multiple vulnerabilities have been discovered in phpMyAdmin. Please
review the CVE identifiers referenced below for details.
<impact type="normal">
<p>A remote authenticated attacker could exploit these vulnerabilities to
execute arbitrary code with the privileges of the process running
phpMyAdmin, inject SQL code, or to conduct Cross-Site Scripting and
Clickjacking attacks.
<p>There is no known workaround at this time.</p>
<p>All phpMyAdmin users should upgrade to the latest version:</p>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=dev-db/phpmyadmin-4.0.5"
<uri link="">CVE-2013-1937</uri>
<uri link="">CVE-2013-3238</uri>
<uri link="">CVE-2013-3239</uri>
<uri link="">CVE-2013-4995</uri>
<uri link="">CVE-2013-4996</uri>
<uri link="">CVE-2013-4997</uri>
<uri link="">CVE-2013-4998</uri>
<uri link="">CVE-2013-4999</uri>
<uri link="">CVE-2013-5000</uri>
<uri link="">CVE-2013-5001</uri>
<uri link="">CVE-2013-5002</uri>
<uri link="">CVE-2013-5003</uri>
<uri link="">CVE-2013-5029</uri>
<metadata tag="requester" timestamp="Sat, 24 Aug 2013 20:08:03 +0000">a3li</metadata>
<metadata tag="submitter" timestamp="Mon, 04 Nov 2013 11:28:46 +0000">a3li</metadata>