Lucene search

K
debianDebianDEBIAN:E6B3DC88A76C7B2DC2E0A8C753CA0F6C:908EC
HistoryJul 09, 2014 - 7:24 p.m.

phpmyadmin security update

2014-07-0919:24:50
lists.debian.org
16

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.043 Low

EPSS

Percentile

91.4%

Package : phpmyadmin
Version : 4:3.3.7-8
CVE ID : CVE-2013-3239 CVE-2013-4995 CVE-2013-4996 CVE-2013-5003

Several vulnerabilities have been discovered in phpMyAdmin, a tool to
administer MySQL over the web. The Common Vulnerabilities and Exposures
project identifies the following problems:

CVE-2013-3239

Authenticated users could execute arbitrary code, when a SaveDir
directory is configured and Apache HTTP Server has the mod_mime
module enabled, by employing double filename extensions.

CVE-2013-4995

Authenticatd users could inject arbitrary web script or HTML
via a crafted SQL query.

CVE-2013-4996

Cross site scripting was possible via a crafted logo URL in
the navigation panel or a crafted entry in the Trusted Proxy list.

CVE-2013-5003

Authenticated users could execute arbitrary SQL commands as
the phpMyAdmin 'control user' via the scale parameter of PMD PDF
export.

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.043 Low

EPSS

Percentile

91.4%