You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa phpMyAdmin

Sigurnosni nedostaci programskog paketa phpMyAdmin

by ncert - 0

——————————————————————————–
Fedora Update Notification
FEDORA-2016-e1fe01e96e
2016-02-01 02:27:04.519021
——————————————————————————–

Name : phpMyAdmin
Product : Fedora 22
Version : 4.5.4
Release : 1.fc22
URL : https://www.phpmyadmin.net/
Summary : Handle the administration of MySQL over the World Wide Web
Description :
phpMyAdmin is a tool written in PHP intended to handle the administration of
MySQL over the World Wide Web. Most frequently used operations are supported
by the user interface (managing databases, tables, fields, relations, indexes,
users, permissions), while you still have the ability to directly execute any
SQL statement.

Features include an intuitive web interface, support for most MySQL features
(browse and drop databases, tables, views, fields and indexes, create, copy,
drop, rename and alter databases, tables, fields and indexes, maintenance
server, databases and tables, with proposals on server configuration, execute,
edit and bookmark any SQL-statement, even batch-queries, manage MySQL users
and privileges, manage stored procedures and triggers), import data from CSV
and SQL, export data to various formats: CSV, SQL, XML, PDF, OpenDocument Text
and Spreadsheet, Word, Excel, LATEX and others, administering multiple servers,
creating PDF graphics of your database layout, creating complex queries using
Query-by-example (QBE), searching globally in a database or a subset of it,
transforming stored data into any format using a set of predefined functions,
like displaying BLOB-data as image or download-link and much more…

——————————————————————————–
Update Information:

phpMyAdmin 4.5.4 (2016-01-28) ============================= – live data edit of
big sets is not working – Table list not saved in db QBE bookmarked search –
While ‘changing a column’, query fails with a syntax error after the ‘CHARSET=’
keyword – Avoid syntax error in javascript messages on invalid PHP setting for
max_input_vars – Properly handle errors in upacking zip archive – Set PHP’s
internal encoding to UTF-8 – Fixed Kanji encoding in some specific cases – Check
whether iconv works before using it – Avoid conversion of MySQL error messages –
Undefined index: parameters – Undefined index: field_name_orig – Undefined
index: host – ‘Add to central columns’ (per column button) does nothing – SQL
duplicate entry error trying to INSERT in designer_settings table – Fix handling
of databases with dot in a name – Fix hiding of page content behind menu – FROM
clause not generated after loading search bookmark – Fix creating/editing VIEW
with DEFINER containing special chars – Do not invoke FLUSH PRIVILEGES when
server in –skip-grant-tables – Misleading message for configuration storage –
Table pagination does nothing when session expired – Index comments not working
properly – Better handle local storage errors – Improve detection of privileges
for privilege adjusting – Undefined property: stdClass::$releases at version
check when disabled in config – SQL comment and variable stripped from bookmark
on save – Gracefully handle errors in regex based javascript search – [Security]
Multiple full path disclosure vulnerabilities, see PMASA-2016-1 – [Security]
Unsafe generation of CSRF token, see PMASA-2016-2 – [Security] Multiple XSS
vulnerabilities, see PMASA-2016-3 – [Security] Insecure password generation in
JavaScript, see PMASA-2016-4 – [Security] Unsafe comparison of CSRF token, see
PMASA-2016-5 – [Security] Multiple full path disclosure vulnerabilities, see
PMASA-2016-6 – [Security] XSS vulnerability in normalization page, see
PMASA-2016-7 – [Security] Full path disclosure vulnerability in SQL parser, see
PMASA-2016-8 – [Security] XSS vulnerability in SQL editor, see PMASA-2016-9
——————————————————————————–
References:

[ 1 ] Bug #1302676 – CVE-2016-2038 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-1)
https://bugzilla.redhat.com/show_bug.cgi?id=1302676
[ 2 ] Bug #1302677 – CVE-2016-2039 phpMyAdmin: Unsafe generation of XSRF/CSRF token (PMASA-2016-2)
https://bugzilla.redhat.com/show_bug.cgi?id=1302677
[ 3 ] Bug #1302679 – CVE-2016-2040 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2016-3)
https://bugzilla.redhat.com/show_bug.cgi?id=1302679
[ 4 ] Bug #1302680 – CVE-2016-1927 phpMyAdmin: Insecure password generation in JavaScript (PMASA-2016-4)
https://bugzilla.redhat.com/show_bug.cgi?id=1302680
[ 5 ] Bug #1302681 – CVE-2016-2041 phpMyAdmin: Unsafe comparison of XSRF/CSRF token (PMASA-2016-5)
https://bugzilla.redhat.com/show_bug.cgi?id=1302681
[ 6 ] Bug #1302682 – CVE-2016-2042 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-6)
https://bugzilla.redhat.com/show_bug.cgi?id=1302682
[ 7 ] Bug #1302684 – CVE-2016-2043 phpMyAdmin: XSS vulnerability in normalization page (PMASA-2016-7)
https://bugzilla.redhat.com/show_bug.cgi?id=1302684
[ 8 ] Bug #1302685 – CVE-2016-2044 phpMyAdmin: Full path disclosure vulnerability in SQL parser (PMASA-2016-8)
https://bugzilla.redhat.com/show_bug.cgi?id=1302685
[ 9 ] Bug #1302686 – CVE-2016-2045 phpMyAdmin: XSS vulnerability in SQL editor (PMASA-2016-9)
https://bugzilla.redhat.com/show_bug.cgi?id=1302686
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update phpMyAdmin’ at the command line.
For more information, refer to “Managing Software with yum”,
available at https://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2016-e55278763e
2016-02-03 17:23:42.908770
--------------------------------------------------------------------------------

Name        : phpMyAdmin
Product     : Fedora 23
Version     : 4.5.4.1
Release     : 1.fc23
URL         : https://www.phpmyadmin.net/
Summary     : Handle the administration of MySQL over the World Wide Web
Description :
phpMyAdmin is a tool written in PHP intended to handle the administration of
MySQL over the World Wide Web. Most frequently used operations are supported
by the user interface (managing databases, tables, fields, relations, indexes,
users, permissions), while you still have the ability to directly execute any
SQL statement.

Features include an intuitive web interface, support for most MySQL features
(browse and drop databases, tables, views, fields and indexes, create, copy,
drop, rename and alter databases, tables, fields and indexes, maintenance
server, databases and tables, with proposals on server configuration, execute,
edit and bookmark any SQL-statement, even batch-queries, manage MySQL users
and privileges, manage stored procedures and triggers), import data from CSV
and SQL, export data to various formats: CSV, SQL, XML, PDF, OpenDocument Text
and Spreadsheet, Word, Excel, LATEX and others, administering multiple servers,
creating PDF graphics of your database layout, creating complex queries using
Query-by-example (QBE), searching globally in a database or a subset of it,
transforming stored data into any format using a set of predefined functions,
like displaying BLOB-data as image or download-link and much more...

--------------------------------------------------------------------------------
Update Information:

phpMyAdmin 4.5.4.1 (2016-01-28) ===============================  - Error with
PMA 4.4.15.3 - Remove hard dependency on phpseclib   phpMyAdmin 4.5.4
(2016-01-28) =============================  - live data edit of big sets is not
working - Table list not saved in db QBE bookmarked search - While 'changing a
column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid
syntax error in javascript messages on invalid PHP setting for max_input_vars -
Properly handle errors in upacking zip archive - Set PHP's internal encoding to
UTF-8 - Fixed Kanji encoding in some specific cases - Check whether iconv works
before using it - Avoid conversion of MySQL error messages - Undefined index:
parameters - Undefined index: field_name_orig - Undefined index: host - 'Add to
central columns' (per column button) does nothing - SQL duplicate entry error
trying to INSERT in designer_settings table - Fix handling of databases with dot
in a name - Fix hiding of page content behind menu - FROM clause not generated
after loading search bookmark - Fix creating/editing VIEW with DEFINER
containing special chars - Do not invoke FLUSH PRIVILEGES when server in --skip-
grant-tables - Misleading message for configuration storage - Table pagination
does nothing when session expired - Index comments not working properly - Better
handle local storage errors - Improve detection of privileges for privilege
adjusting - Undefined property: stdClass::$releases at version check when
disabled in config - SQL comment and variable stripped from bookmark on save -
Gracefully handle errors in regex based javascript search - [Security] Multiple
full path disclosure vulnerabilities, see PMASA-2016-1 - [Security] Unsafe
generation of CSRF token, see PMASA-2016-2 - [Security] Multiple XSS
vulnerabilities, see PMASA-2016-3 - [Security] Insecure password generation in
JavaScript, see PMASA-2016-4 - [Security] Unsafe comparison of CSRF token, see
PMASA-2016-5 - [Security] Multiple full path disclosure vulnerabilities, see
PMASA-2016-6 - [Security] XSS vulnerability in normalization page, see
PMASA-2016-7 - [Security] Full path disclosure vulnerability in SQL parser, see
PMASA-2016-8 - [Security] XSS vulnerability in SQL editor, see PMASA-2016-9
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1302686 - CVE-2016-2045 phpMyAdmin: XSS vulnerability in SQL editor (PMASA-2016-9)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302686
  [ 2 ] Bug #1302685 - CVE-2016-2044 phpMyAdmin: Full path disclosure vulnerability in SQL parser (PMASA-2016-8)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302685
  [ 3 ] Bug #1302684 - CVE-2016-2043 phpMyAdmin: XSS vulnerability in normalization page (PMASA-2016-7)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302684
  [ 4 ] Bug #1302682 - CVE-2016-2042 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-6)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302682
  [ 5 ] Bug #1302681 - CVE-2016-2041 phpMyAdmin: Unsafe comparison of XSRF/CSRF token (PMASA-2016-5)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302681
  [ 6 ] Bug #1302680 - CVE-2016-1927 phpMyAdmin: Insecure password generation in JavaScript (PMASA-2016-4)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302680
  [ 7 ] Bug #1302679 - CVE-2016-2040 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2016-3)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302679
  [ 8 ] Bug #1302677 - CVE-2016-2039 phpMyAdmin: Unsafe generation of XSRF/CSRF token (PMASA-2016-2)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302677
  [ 9 ] Bug #1302676 - CVE-2016-2038 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-1)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302676
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program. Use
su -c 'yum update phpMyAdmin' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce
ncert
Top
More in Preporuke
Sigurnosni nedostaci programskog paketa webkitgtk4

Otkriveni su višestruki sigurnosni nedostaci u programskom paketu webkitgtk4 za operacijski sustav Fedora. Otkriveni nedostaci potencijalnim napadačima omogućuju izvođenje napada...

Close