[SECURITY] Fedora 22 Update: phpMyAdmin-4.5.4-1.fc22

Mon Feb 1 06:34:04 UTC 2016

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2016-e1fe01e96e
2016-02-01 02:27:04.519021
--------------------------------------------------------------------------------

Name        : phpMyAdmin
Product     : Fedora 22
Version     : 4.5.4
Release     : 1.fc22
URL         : https://www.phpmyadmin.net/
Summary     : Handle the administration of MySQL over the World Wide Web
Description :
phpMyAdmin is a tool written in PHP intended to handle the administration of
MySQL over the World Wide Web. Most frequently used operations are supported
by the user interface (managing databases, tables, fields, relations, indexes,
users, permissions), while you still have the ability to directly execute any
SQL statement.

Features include an intuitive web interface, support for most MySQL features
(browse and drop databases, tables, views, fields and indexes, create, copy,
drop, rename and alter databases, tables, fields and indexes, maintenance
server, databases and tables, with proposals on server configuration, execute,
edit and bookmark any SQL-statement, even batch-queries, manage MySQL users
and privileges, manage stored procedures and triggers), import data from CSV
and SQL, export data to various formats: CSV, SQL, XML, PDF, OpenDocument Text
and Spreadsheet, Word, Excel, LATEX and others, administering multiple servers,
creating PDF graphics of your database layout, creating complex queries using
Query-by-example (QBE), searching globally in a database or a subset of it,
transforming stored data into any format using a set of predefined functions,
like displaying BLOB-data as image or download-link and much more...

--------------------------------------------------------------------------------
Update Information:

phpMyAdmin 4.5.4 (2016-01-28) =============================  - live data edit of
big sets is not working - Table list not saved in db QBE bookmarked search -
While 'changing a column', query fails with a syntax error after the 'CHARSET='
keyword - Avoid syntax error in javascript messages on invalid PHP setting for
max_input_vars - Properly handle errors in upacking zip archive - Set PHP's
internal encoding to UTF-8 - Fixed Kanji encoding in some specific cases - Check
whether iconv works before using it - Avoid conversion of MySQL error messages -
Undefined index: parameters - Undefined index: field_name_orig - Undefined
index: host - 'Add to central columns' (per column button) does nothing - SQL
duplicate entry error trying to INSERT in designer_settings table - Fix handling
of databases with dot in a name - Fix hiding of page content behind menu - FROM
clause not generated after loading search bookmark - Fix creating/editing VIEW
with DEFINER containing special chars - Do not invoke FLUSH PRIVILEGES when
server in --skip-grant-tables - Misleading message for configuration storage -
Table pagination does nothing when session expired - Index comments not working
properly - Better handle local storage errors - Improve detection of privileges
for privilege adjusting - Undefined property: stdClass::$releases at version
check when disabled in config - SQL comment and variable stripped from bookmark
on save - Gracefully handle errors in regex based javascript search - [Security]
Multiple full path disclosure vulnerabilities, see PMASA-2016-1 - [Security]
Unsafe generation of CSRF token, see PMASA-2016-2 - [Security] Multiple XSS
vulnerabilities, see PMASA-2016-3 - [Security] Insecure password generation in
JavaScript, see PMASA-2016-4 - [Security] Unsafe comparison of CSRF token, see
PMASA-2016-5 - [Security] Multiple full path disclosure vulnerabilities, see
PMASA-2016-6 - [Security] XSS vulnerability in normalization page, see
PMASA-2016-7 - [Security] Full path disclosure vulnerability in SQL parser, see
PMASA-2016-8 - [Security] XSS vulnerability in SQL editor, see PMASA-2016-9
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1302676 - CVE-2016-2038 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-1)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302676
  [ 2 ] Bug #1302677 - CVE-2016-2039 phpMyAdmin: Unsafe generation of XSRF/CSRF token (PMASA-2016-2)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302677
  [ 3 ] Bug #1302679 - CVE-2016-2040 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2016-3)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302679
  [ 4 ] Bug #1302680 - CVE-2016-1927 phpMyAdmin: Insecure password generation in JavaScript (PMASA-2016-4)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302680
  [ 5 ] Bug #1302681 - CVE-2016-2041 phpMyAdmin: Unsafe comparison of XSRF/CSRF token (PMASA-2016-5)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302681
  [ 6 ] Bug #1302682 - CVE-2016-2042 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-6)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302682
  [ 7 ] Bug #1302684 - CVE-2016-2043 phpMyAdmin: XSS vulnerability in normalization page (PMASA-2016-7)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302684
  [ 8 ] Bug #1302685 - CVE-2016-2044 phpMyAdmin: Full path disclosure vulnerability in SQL parser (PMASA-2016-8)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302685
  [ 9 ] Bug #1302686 - CVE-2016-2045 phpMyAdmin: XSS vulnerability in SQL editor (PMASA-2016-9)
        https://bugzilla.redhat.com/show_bug.cgi?id=1302686
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program. Use
su -c 'yum update phpMyAdmin' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------