From e9dd2fa24f1c624343da02c7e15e2318a8b74de9 Mon Sep 17 00:00:00 2001 From: Matthew Seaman Date: Wed, 5 Jun 2013 22:02:13 +0000 Subject: [PATCH] Security upgrade to 4.0.3 Advisory: http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php ChangeLog: http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.3/phpMyAdmin-4.0.3-notes.html/view Security: 6b97436c-ce1e-11e2-9cb2-6805ca0b3d42 --- databases/phpmyadmin/Makefile | 2 +- databases/phpmyadmin/distinfo | 4 ++-- security/vuxml/vuln.xml | 31 +++++++++++++++++++++++++++++++ 3 files changed, 34 insertions(+), 3 deletions(-) diff --git a/databases/phpmyadmin/Makefile b/databases/phpmyadmin/Makefile index 512046cf3036..d77e45f7976e 100644 --- a/databases/phpmyadmin/Makefile +++ b/databases/phpmyadmin/Makefile @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= phpMyAdmin -DISTVERSION= 4.0.2 +DISTVERSION= 4.0.3 CATEGORIES= databases www MASTER_SITES= SF/${PORTNAME:L}/${PORTNAME}/${DISTVERSION} DISTNAME= ${PORTNAME}-${DISTVERSION}-all-languages diff --git a/databases/phpmyadmin/distinfo b/databases/phpmyadmin/distinfo index ff95d2aac9e8..3f0c66f2d768 100644 --- a/databases/phpmyadmin/distinfo +++ b/databases/phpmyadmin/distinfo @@ -1,2 +1,2 @@ -SHA256 (phpMyAdmin-4.0.2-all-languages.tar.xz) = fad443ccfbf40c7e54bc04dde32423b9837a50e54771ff4c424ad31561d1082f -SIZE (phpMyAdmin-4.0.2-all-languages.tar.xz) = 4360284 +SHA256 (phpMyAdmin-4.0.3-all-languages.tar.xz) = a1e2d663ee8976402dd18818cc8479eb34019a82553df0009af1036e63629a93 +SIZE (phpMyAdmin-4.0.3-all-languages.tar.xz) = 4400480 diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index d0320018954a..6ba541ccc014 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -51,6 +51,37 @@ Note: Please add new entries to the beginning of this file. --> + + phpMyAdmin -- XSS due to unescaped HTML output in Create View page + + + phpMyAdmin + 4.04.0.3 + + + + +

The phpMyAdmin development team reports:

+
+

When creating a view with a crafted name and an incorrect + CREATE statement, it is possible to trigger an XSS.

+

This vulnerability can be triggered only by someone who + logged in to phpMyAdmin, as the usual token protection + prevents non-logged-in users from accessing the required + form.

+
+ + + + http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php + CVE-2013-3742 + + + 2013-06-05 + 2013-06-05 + + + telepathy-gabble -- TLS verification bypass