An cross-site scripting (XSS) flaw was found in the way phpPgAdmin, a web-based PostgreSQL database administration tool, performed presentation of the default list of functions, being present in the database, to the user upon request. A remote attacker could provide a specially-crafted web page, which once visited by an unsuspecting, valid phpPgAdmin user could lead to arbitrary HTML or web script execution in the context of logged in phpPgAdmin user. References: [1] http://archives.postgresql.org/pgsql-announce/2012-03/msg00016.php [2] https://github.com/phppgadmin/phppgadmin/commit/e92a003624609a445c4cf57c9c3d1fcef0eae47c#diff-0 Upstream patch: [3] https://github.com/phppgadmin/phppgadmin/commit/74174ad639664b52cc1609ede0af8bc403e98a00 CVE request: [4] http://www.openwall.com/lists/oss-security/2012/03/28/11 CVE assignment: [5] http://www.openwall.com/lists/oss-security/2012/03/29/6
This issue previously affected the versions of the phpPgAdmin package, as shipped with Fedora release of 15, 16, and as shipped with Fedora EPEL 5 and Fedora EPEL 6 versions. Though the following phpPgAdmin have been scheduled already: 1) phpPgAdmin-5.0.4-1.fc15 for Fedora 15, 2) phpPgAdmin-5.0.4-1.fc16 for Fedora 16, 3) phpPgAdmin-5.0.4-1.el5 for Fedora EPEL 5, 4) phpPgAdmin-5.0.4-1.el6 for Fedora EPEL 6 to correct this deficiency. Once the above packages have passed the required level of testing, they will be pushed to the -stable repository for each of the particular releases above.