[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 30 Mar 2009 21:26:18 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: phpMyAdmin
======================================================
Name: CVE-2009-1148
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1148
Reference: MISC:http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303&r2=12302&pathrev=12303
Reference: CONFIRM:http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php
Directory traversal vulnerability in bs_disp_as_mime_type.php in the
BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote
attackers to read arbitrary files via directory traversal sequences in
the file_path parameter ($filename variable).
======================================================
Name: CVE-2009-1149
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1149
Reference: MISC:http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303&r2=12302&pathrev=12303
Reference: CONFIRM:http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php
CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB
streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers
to inject arbitrary HTTP headers and conduct HTTP response splitting
attacks via the (1) c_type and possibly (2) file_type parameters.
======================================================
Name: CVE-2009-1150
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1150
Reference: CONFIRM:http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986&r2=12302&pathrev=12302
Reference: CONFIRM:http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php
Multiple cross-site scripting (XSS) vulnerabilities in the export page
(display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x
before 3.1.3.1 allow remote attackers to inject arbitrary web script
or HTML via the pma_db_filename_template cookie.
======================================================
Name: CVE-2009-1151
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1151
Reference: CONFIRM:http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301
Reference: CONFIRM:http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x
before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to
inject arbitrary PHP code into a configuration file via the save
action.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
