[SECURITY] Fedora 23 Update: phpMyAdmin-4.5.4.1-1.fc23
updates at fedoraproject.org
updates at fedoraproject.org
Wed Feb 3 20:52:02 UTC 2016
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2016-e55278763e
2016-02-03 17:23:42.908770
--------------------------------------------------------------------------------
Name : phpMyAdmin
Product : Fedora 23
Version : 4.5.4.1
Release : 1.fc23
URL : https://www.phpmyadmin.net/
Summary : Handle the administration of MySQL over the World Wide Web
Description :
phpMyAdmin is a tool written in PHP intended to handle the administration of
MySQL over the World Wide Web. Most frequently used operations are supported
by the user interface (managing databases, tables, fields, relations, indexes,
users, permissions), while you still have the ability to directly execute any
SQL statement.
Features include an intuitive web interface, support for most MySQL features
(browse and drop databases, tables, views, fields and indexes, create, copy,
drop, rename and alter databases, tables, fields and indexes, maintenance
server, databases and tables, with proposals on server configuration, execute,
edit and bookmark any SQL-statement, even batch-queries, manage MySQL users
and privileges, manage stored procedures and triggers), import data from CSV
and SQL, export data to various formats: CSV, SQL, XML, PDF, OpenDocument Text
and Spreadsheet, Word, Excel, LATEX and others, administering multiple servers,
creating PDF graphics of your database layout, creating complex queries using
Query-by-example (QBE), searching globally in a database or a subset of it,
transforming stored data into any format using a set of predefined functions,
like displaying BLOB-data as image or download-link and much more...
--------------------------------------------------------------------------------
Update Information:
phpMyAdmin 4.5.4.1 (2016-01-28) =============================== - Error with
PMA 4.4.15.3 - Remove hard dependency on phpseclib phpMyAdmin 4.5.4
(2016-01-28) ============================= - live data edit of big sets is not
working - Table list not saved in db QBE bookmarked search - While 'changing a
column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid
syntax error in javascript messages on invalid PHP setting for max_input_vars -
Properly handle errors in upacking zip archive - Set PHP's internal encoding to
UTF-8 - Fixed Kanji encoding in some specific cases - Check whether iconv works
before using it - Avoid conversion of MySQL error messages - Undefined index:
parameters - Undefined index: field_name_orig - Undefined index: host - 'Add to
central columns' (per column button) does nothing - SQL duplicate entry error
trying to INSERT in designer_settings table - Fix handling of databases with dot
in a name - Fix hiding of page content behind menu - FROM clause not generated
after loading search bookmark - Fix creating/editing VIEW with DEFINER
containing special chars - Do not invoke FLUSH PRIVILEGES when server in --skip-
grant-tables - Misleading message for configuration storage - Table pagination
does nothing when session expired - Index comments not working properly - Better
handle local storage errors - Improve detection of privileges for privilege
adjusting - Undefined property: stdClass::$releases at version check when
disabled in config - SQL comment and variable stripped from bookmark on save -
Gracefully handle errors in regex based javascript search - [Security] Multiple
full path disclosure vulnerabilities, see PMASA-2016-1 - [Security] Unsafe
generation of CSRF token, see PMASA-2016-2 - [Security] Multiple XSS
vulnerabilities, see PMASA-2016-3 - [Security] Insecure password generation in
JavaScript, see PMASA-2016-4 - [Security] Unsafe comparison of CSRF token, see
PMASA-2016-5 - [Security] Multiple full path disclosure vulnerabilities, see
PMASA-2016-6 - [Security] XSS vulnerability in normalization page, see
PMASA-2016-7 - [Security] Full path disclosure vulnerability in SQL parser, see
PMASA-2016-8 - [Security] XSS vulnerability in SQL editor, see PMASA-2016-9
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1302686 - CVE-2016-2045 phpMyAdmin: XSS vulnerability in SQL editor (PMASA-2016-9)
https://bugzilla.redhat.com/show_bug.cgi?id=1302686
[ 2 ] Bug #1302685 - CVE-2016-2044 phpMyAdmin: Full path disclosure vulnerability in SQL parser (PMASA-2016-8)
https://bugzilla.redhat.com/show_bug.cgi?id=1302685
[ 3 ] Bug #1302684 - CVE-2016-2043 phpMyAdmin: XSS vulnerability in normalization page (PMASA-2016-7)
https://bugzilla.redhat.com/show_bug.cgi?id=1302684
[ 4 ] Bug #1302682 - CVE-2016-2042 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-6)
https://bugzilla.redhat.com/show_bug.cgi?id=1302682
[ 5 ] Bug #1302681 - CVE-2016-2041 phpMyAdmin: Unsafe comparison of XSRF/CSRF token (PMASA-2016-5)
https://bugzilla.redhat.com/show_bug.cgi?id=1302681
[ 6 ] Bug #1302680 - CVE-2016-1927 phpMyAdmin: Insecure password generation in JavaScript (PMASA-2016-4)
https://bugzilla.redhat.com/show_bug.cgi?id=1302680
[ 7 ] Bug #1302679 - CVE-2016-2040 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2016-3)
https://bugzilla.redhat.com/show_bug.cgi?id=1302679
[ 8 ] Bug #1302677 - CVE-2016-2039 phpMyAdmin: Unsafe generation of XSRF/CSRF token (PMASA-2016-2)
https://bugzilla.redhat.com/show_bug.cgi?id=1302677
[ 9 ] Bug #1302676 - CVE-2016-2038 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-1)
https://bugzilla.redhat.com/show_bug.cgi?id=1302676
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update phpMyAdmin' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
More information about the package-announce
mailing list