—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:046
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : phpmyadmin
Date : February 21, 2014
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability has been discovered and corrected in phpmyadmin:

Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin
before 4.1.7 allows remote authenticated users to inject arbitrary
web script or HTML via a crafted filename in an import action
(CVE-2014-1879).

This upgrade provides the latest phpmyadmin version (4.1.7) to address
this vulnerability.

Additionally phpseclib packages has been added due to new dependencies.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1879
http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
c263bd5b965453ba650bb81a711768eb mes5/i586/phpmyadmin-4.1.7-0.1mdvmes5.2.noarch.rpm
defc507ff8600e6188b7e405ea0bb008 mes5/i586/phpseclib-0.3.5-0.1mdvmes5.2.noarch.rpm
3774e20f2f2f66c79986b4882781b82f mes5/SRPMS/phpmyadmin-4.1.7-0.1mdvmes5.2.src.rpm
2243c59f2967dcb463ea444569013862 mes5/SRPMS/phpseclib-0.3.5-0.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
dbc67b08ffc4c7a25a27d092e2bff4eb mes5/x86_64/phpmyadmin-4.1.7-0.1mdvmes5.2.noarch.rpm
7e740e3937991151e80fea25f8747a5b mes5/x86_64/phpseclib-0.3.5-0.1mdvmes5.2.noarch.rpm
3774e20f2f2f66c79986b4882781b82f mes5/SRPMS/phpmyadmin-4.1.7-0.1mdvmes5.2.src.rpm
2243c59f2967dcb463ea444569013862 mes5/SRPMS/phpseclib-0.3.5-0.1mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
385122f1d627a1107ab0bb93cd343984 mbs1/x86_64/phpmyadmin-4.1.7-1.mbs1.noarch.rpm
a27ce27fa10c5750558198f78aaf6626 mbs1/x86_64/phpseclib-0.3.5-1.mbs1.noarch.rpm
f8a14ae4521da88c222fae2c4f2d409b mbs1/SRPMS/phpmyadmin-4.1.7-1.mbs1.src.rpm
7dadbad52a3e80ce9b6dc294db313202 mbs1/SRPMS/phpseclib-0.3.5-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTBycEmqjQ0CJFipgRAgsdAJ462zo1iNvM+igFAhA45Z6utcbcEgCg9beb
1hXHfpHC2lTTcODyTFzXdh4=
=EktW
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________