Mailinglist Archive: opensuse-updates (48 mails)
< Previous | Next > |
openSUSE-SU-2014:1069-1: moderate: update for phpMyAdmin
- From: opensuse-security@xxxxxxxxxxxx
- Date: Thu, 28 Aug 2014 11:05:02 +0200 (CEST)
- Message-id: <20140828090503.00D72321C9@maintenance.suse.de>
openSUSE Security Update: update for phpMyAdmin
______________________________________________________________________________
Announcement ID: openSUSE-SU-2014:1069-1
Rating: moderate
References: #892401
Cross-References: CVE-2014-4349 CVE-2014-4955 CVE-2014-4986
CVE-2014-4987 CVE-2014-5273 CVE-2014-5274
Affected Products:
openSUSE 13.1
openSUSE 12.3
______________________________________________________________________________
An update that fixes 6 vulnerabilities is now available.
Description:
This phpMyAdmin update addresses several security and non security issues:
- This is a phpMyAdmin version upgrade (bnc#892401): (From 4.1.14.3):
* sf#4501 [security] XSS in table browse page (CVE-2014-5273)
* sf#4502 [security] Self-XSS in enum value editor (CVE-2014-5273)
* sf#4503 [security] Self-XSSes in monitor (CVE-2014-5273)
* sf#4505 [security] XSS in view operations page (CVE-2014-5274)
* sf#4504 [security] Self-XSS in query charts (CVE-2014-5273)
* sf#4517 [security] XSS in relation view (CVE-2014-5273) (From
4.1.14.2):
* sf#4488 [security] XSS injection due to unescaped table name
(triggers)(CVE-2014-4955)
* sf#4492 [security] XSS in AJAX confirmation messages (CVE-2014-4986)
* sf#4491 [security] Missing validation for accessing User groups
feature (CVE-2014-4987) (From 4.1.14.1):
* sf#4464 [security] XSS injection due to unescaped db/table name in
navigation hiding (CVE-2014-4349) (From 4.1.14.0 through 4.1.9.0):
* Numerous non-security bugfixes are listed at
https://github.com/phpmyadmin/phpmyadmin/blob/MAINT_4_1_14/ChangeLog
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 13.1:
zypper in -t patch openSUSE-2014-518
- openSUSE 12.3:
zypper in -t patch openSUSE-2014-518
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 13.1 (noarch):
phpMyAdmin-4.1.14.3-8.1
- openSUSE 12.3 (noarch):
phpMyAdmin-4.1.14.3-1.16.1
References:
http://support.novell.com/security/cve/CVE-2014-4349.html
http://support.novell.com/security/cve/CVE-2014-4955.html
http://support.novell.com/security/cve/CVE-2014-4986.html
http://support.novell.com/security/cve/CVE-2014-4987.html
http://support.novell.com/security/cve/CVE-2014-5273.html
http://support.novell.com/security/cve/CVE-2014-5274.html
https://bugzilla.novell.com/892401
______________________________________________________________________________
Announcement ID: openSUSE-SU-2014:1069-1
Rating: moderate
References: #892401
Cross-References: CVE-2014-4349 CVE-2014-4955 CVE-2014-4986
CVE-2014-4987 CVE-2014-5273 CVE-2014-5274
Affected Products:
openSUSE 13.1
openSUSE 12.3
______________________________________________________________________________
An update that fixes 6 vulnerabilities is now available.
Description:
This phpMyAdmin update addresses several security and non security issues:
- This is a phpMyAdmin version upgrade (bnc#892401): (From 4.1.14.3):
* sf#4501 [security] XSS in table browse page (CVE-2014-5273)
* sf#4502 [security] Self-XSS in enum value editor (CVE-2014-5273)
* sf#4503 [security] Self-XSSes in monitor (CVE-2014-5273)
* sf#4505 [security] XSS in view operations page (CVE-2014-5274)
* sf#4504 [security] Self-XSS in query charts (CVE-2014-5273)
* sf#4517 [security] XSS in relation view (CVE-2014-5273) (From
4.1.14.2):
* sf#4488 [security] XSS injection due to unescaped table name
(triggers)(CVE-2014-4955)
* sf#4492 [security] XSS in AJAX confirmation messages (CVE-2014-4986)
* sf#4491 [security] Missing validation for accessing User groups
feature (CVE-2014-4987) (From 4.1.14.1):
* sf#4464 [security] XSS injection due to unescaped db/table name in
navigation hiding (CVE-2014-4349) (From 4.1.14.0 through 4.1.9.0):
* Numerous non-security bugfixes are listed at
https://github.com/phpmyadmin/phpmyadmin/blob/MAINT_4_1_14/ChangeLog
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 13.1:
zypper in -t patch openSUSE-2014-518
- openSUSE 12.3:
zypper in -t patch openSUSE-2014-518
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 13.1 (noarch):
phpMyAdmin-4.1.14.3-8.1
- openSUSE 12.3 (noarch):
phpMyAdmin-4.1.14.3-1.16.1
References:
http://support.novell.com/security/cve/CVE-2014-4349.html
http://support.novell.com/security/cve/CVE-2014-4955.html
http://support.novell.com/security/cve/CVE-2014-4986.html
http://support.novell.com/security/cve/CVE-2014-4987.html
http://support.novell.com/security/cve/CVE-2014-5273.html
http://support.novell.com/security/cve/CVE-2014-5274.html
https://bugzilla.novell.com/892401
< Previous | Next > |