openSUSE Security Update: update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1069-1 Rating: moderate References: #892401 Cross-References: CVE-2014-4349 CVE-2014-4955 CVE-2014-4986 CVE-2014-4987 CVE-2014-5273 CVE-2014-5274 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This phpMyAdmin update addresses several security and non security issues: - This is a phpMyAdmin version upgrade (bnc#892401): (From 4.1.14.3): * sf#4501 [security] XSS in table browse page (CVE-2014-5273) * sf#4502 [security] Self-XSS in enum value editor (CVE-2014-5273) * sf#4503 [security] Self-XSSes in monitor (CVE-2014-5273) * sf#4505 [security] XSS in view operations page (CVE-2014-5274) * sf#4504 [security] Self-XSS in query charts (CVE-2014-5273) * sf#4517 [security] XSS in relation view (CVE-2014-5273) (From 4.1.14.2): * sf#4488 [security] XSS injection due to unescaped table name (triggers)(CVE-2014-4955) * sf#4492 [security] XSS in AJAX confirmation messages (CVE-2014-4986) * sf#4491 [security] Missing validation for accessing User groups feature (CVE-2014-4987) (From 4.1.14.1): * sf#4464 [security] XSS injection due to unescaped db/table name in navigation hiding (CVE-2014-4349) (From 4.1.14.0 through 4.1.9.0): * Numerous non-security bugfixes are listed at https://github.com/phpmyadmin/phpmyadmin/blob/MAINT_4_1_14/ChangeLog Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-518 - openSUSE 12.3: zypper in -t patch openSUSE-2014-518 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): phpMyAdmin-4.1.14.3-8.1 - openSUSE 12.3 (noarch): phpMyAdmin-4.1.14.3-1.16.1 References: http://support.novell.com/security/cve/CVE-2014-4349.html http://support.novell.com/security/cve/CVE-2014-4955.html http://support.novell.com/security/cve/CVE-2014-4986.html http://support.novell.com/security/cve/CVE-2014-4987.html http://support.novell.com/security/cve/CVE-2014-5273.html http://support.novell.com/security/cve/CVE-2014-5274.html https://bugzilla.novell.com/892401