Lucene search

K
mageiaGentoo FoundationMGASA-2014-0310
HistoryAug 06, 2014 - 12:08 a.m.

Updated phpmyadmin package fixes security vulnerabilities

2014-08-0600:08:48
Gentoo Foundation
advisories.mageia.org
7

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

53.2%

In phpMyAdmin before 4.1.14.2, when navigating into the database triggers page, it is possible to trigger an XSS with a crafted trigger name (CVE-2014-4955). In phpMyAdmin before 4.1.14.2, with a crafted column name it is possible to trigger an XSS when dropping the column in table structure page. With a crafted table name it is possible to trigger an XSS when dropping or truncating the table in table operations page (CVE-2014-4986). In phpMyAdmin before 4.1.14.2, An unpriviledged user could view the MySQL user list and manipulate the tabs displayed in phpMyAdmin for them (CVE-2014-4987).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchphpmyadmin< 4.1.14.2-1phpmyadmin-4.1.14.2-1.mga3
Mageia4noarchphpmyadmin< 4.1.14.2-1phpmyadmin-4.1.14.2-1.mga4

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

53.2%