Bugzilla – Bug 814678
VUL-1: phpMyAdmin: Self-XSS in phpmyadmin fixed in 3.5.8
Last modified: 2015-02-19 02:49:04 UTC
Hi. There is a security bug in package 'phpMyAdmin'. This information is from 'oss-security'. This bug is public. There is no coordinated release date (CRD) set. More information can be found here: https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a CVE number: CVE-2013-1937 CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1937 CVSS v2 Base Score: 2.6 (moderate) (AV:N/AC:H/Au:N/C:N/I:P/A:N) Original posting: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-1937 - -------- Original-Nachricht -------- Betreff: [oss-security] CVE Request: Self-XSS in phpmyadmin fixed in 3.5.8 Datum: Tue, 9 Apr 2013 14:01:24 +0200 Von: Salvatore Bonaccorso <carnil@debian.org> Antwort an: oss-security@lists.openwall.com An: OSS Security Mailinglist <oss-security@lists.openwall.com> Hi Kurt New phpMyAdmin release (3.5.8) contains the following changelog entry: 3.5.8.0 (2013-04-08) - - bug #3828 MariaDB reported as MySQL - - bug #3854 Incorrect header for Safari 6.0 - - bug #3705 Attempt to open trigger for edit gives NULL - - Use HTML5 DOCTYPE - - [security] Self-XSS on GIS visualisation page, reported by Janek Vind - - bug #3800 Incorrect keyhandler behaviour #2 refering to a XSS vulnerability on the GIS visualisation page. [1] is the reference by Janek Vind, upstream commit afaics [2]. [1]: http://seclists.org/fulldisclosure/2013/Apr/100 [2]: https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a Could a CVE be assigned to this issue? Regards, Salvatore -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJRZYBbAAoJEJqHoVJVjr8DFN4H/jafo/Y7Q4/FWVWFls0fhQUV DebO8z9PXsTIGxzcQDBsflotCxvWMhtUMPOob7YOvs0K3UFV36zcd5MvHJBsS/kW UU7kShuLffQ0QHJaKYqpWmGJlSQIB7tAq71kDyp6T+vo5URTbCZWHR6zsEqE+ooK rlEOANRztsHWGmbHhtTc7EXwfotQGrXbKG2c9mAdzV/zwI34V8kE5BfGWeDjTmUz rSVi+yBsTf9TU6wfZy9/RUSgy9DONewqRkwuLInGapDixZkZX6wMNiwXaQX2PKjy Sd2vxW2sM0ujsKgVp4ALUl8dH7VzejL1h1z3LEeYK1QvfYY6SxEKLXxUpa/sdkQ= =DaMZ -----END PGP SIGNATURE-----
bugbot adjusting priority
fixed with update on Apr, 8th 2013
openSUSE-SU-2013:1065-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 814678,824301,824302 CVE References: CVE-2013-1937,CVE-2013-3238,CVE-2013-3239 Sources used: openSUSE 12.3 (src): phpMyAdmin-3.5.8.1-1.4.1 openSUSE 12.2 (src): phpMyAdmin-3.5.8.1-1.12.1