Bug 814678 - VUL-1: phpMyAdmin: Self-XSS in phpmyadmin fixed in 3.5.8
VUL-1: phpMyAdmin: Self-XSS in phpmyadmin fixed in 3.5.8
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: General
unspecified
Other Other
: P4 - Low : Major
: ---
Assigned To: Christian Wittmer
Security Team bot
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-04-10 15:10 UTC by Thomas Biege
Modified: 2015-02-19 02:49 UTC (History)
1 user (show)

See Also:
Found By: Development
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Biege 2013-04-10 15:10:27 UTC
Hi.
There is a security bug in package 'phpMyAdmin'.

This information is from 'oss-security'.

This bug is public.

There is no coordinated release date (CRD) set.

More information can be found here:
	https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a

CVE number: CVE-2013-1937
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1937
CVSS v2 Base Score: 2.6 (moderate) (AV:N/AC:H/Au:N/C:N/I:P/A:N)


Original posting:



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2013-1937

- -------- Original-Nachricht --------
Betreff: [oss-security] CVE Request: Self-XSS in phpmyadmin fixed in 3.5.8
Datum: Tue, 9 Apr 2013 14:01:24 +0200
Von: Salvatore Bonaccorso <carnil@debian.org>
Antwort an: oss-security@lists.openwall.com
An: OSS Security Mailinglist <oss-security@lists.openwall.com>

Hi Kurt

New phpMyAdmin release (3.5.8) contains the following changelog entry:

3.5.8.0 (2013-04-08)
- - bug #3828 MariaDB reported as MySQL
- - bug #3854 Incorrect header for Safari 6.0
- - bug #3705 Attempt to open trigger for edit gives NULL
- - Use HTML5 DOCTYPE
- - [security] Self-XSS on GIS visualisation page, reported by Janek Vind
- - bug #3800 Incorrect keyhandler behaviour #2

refering to a XSS vulnerability on the GIS visualisation page. [1] is
the reference by Janek Vind, upstream commit afaics [2].

 [1]: http://seclists.org/fulldisclosure/2013/Apr/100
 [2]:
https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a

Could a CVE be assigned to this issue?

Regards,
Salvatore


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJRZYBbAAoJEJqHoVJVjr8DFN4H/jafo/Y7Q4/FWVWFls0fhQUV
DebO8z9PXsTIGxzcQDBsflotCxvWMhtUMPOob7YOvs0K3UFV36zcd5MvHJBsS/kW
UU7kShuLffQ0QHJaKYqpWmGJlSQIB7tAq71kDyp6T+vo5URTbCZWHR6zsEqE+ooK
rlEOANRztsHWGmbHhtTc7EXwfotQGrXbKG2c9mAdzV/zwI34V8kE5BfGWeDjTmUz
rSVi+yBsTf9TU6wfZy9/RUSgy9DONewqRkwuLInGapDixZkZX6wMNiwXaQX2PKjy
Sd2vxW2sM0ujsKgVp4ALUl8dH7VzejL1h1z3LEeYK1QvfYY6SxEKLXxUpa/sdkQ=
=DaMZ
-----END PGP SIGNATURE-----
Comment 1 Swamp Workflow Management 2013-04-10 22:00:23 UTC
bugbot adjusting priority
Comment 2 Christian Wittmer 2013-06-10 10:05:23 UTC
fixed with update on Apr, 8th 2013
Comment 3 Swamp Workflow Management 2013-06-21 05:04:53 UTC
openSUSE-SU-2013:1065-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 814678,824301,824302
CVE References: CVE-2013-1937,CVE-2013-3238,CVE-2013-3239
Sources used:
openSUSE 12.3 (src):    phpMyAdmin-3.5.8.1-1.4.1
openSUSE 12.2 (src):    phpMyAdmin-3.5.8.1-1.12.1