Description of problem: phpMyAdmin < 2.11.8-rc1 contains two not yet clearly documented security bugs: "Welcome to phpMyAdmin 2.11.8-rc1, the first release candidate containing normal bug fixes and two security fixes. The security announcement will follow [...]" Additional info (http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0): Fixes for 2.11.8.x: - patch #1987593 [interface] Table list pagination in navi - bug #1989081 [profiling] Profiling causes query to be executed again (really causes a problem in case of INSERT/UPDATE) - bug #1990342 [import] SQL file import very slow on Windows - bug [XHTML] problem with tabindex and radio fields - bug #1971221 [interface] tabindex not set correctly - bug [views] VIEW name created via the GUI was not protected with backquotes - bug #1989813 [interface] Deleting multiple views (space in name) - bug #1992628 [parser] SQL parser removes essential space - bug #1989281 [export] CSV for MS Excel incorrect escaping of double quotes - bug #1959855 [interface] Font size option problem when no config file - bug #1982489 [relation] Relationship view should check for changes - bug [history] Do not save too big queries in history - [security] Do not show version info on login screen - bug #2018595 [import] Potential data loss on import resubmit - patch #2020630 [export] Safari and timedate - bug #2022182 [import, export] Import/Export fails because of Mac files - [security] protection against cross-frame scripting and new directive AllowThirdPartyFraming - [security] possible XSS during setup - [interface] revert language changing problem introduced with 2.11.7.1
phpMyAdmin-2.11.8-0.1.fc9 has been submitted as an update for Fedora 9
phpMyAdmin-2.11.8-0.1.fc8 has been submitted as an update for Fedora 8
Maybe let us wait for 2.11.8 final which already should be around the corner as per upstream now.
Robert, if you prefer to wait, just revoke update request or change type to testing and update it with new build once upstream final is out.
Revoked.
phpMyAdmin-2.11.8-1.fc8 has been submitted as an update for Fedora 8
phpMyAdmin-2.11.8-1.fc9 has been submitted as an update for Fedora 9
Okay, here we can go now ;-)
Bah! phpMyAdmin 2.11.8 is already obsoleted by 2.11.8.1 which is currently building...
phpMyAdmin-2.11.8.1-1.fc8 has been submitted as an update for Fedora 8
phpMyAdmin-2.11.8.1-1.fc9 has been submitted as an update for Fedora 9
phpMyAdmin-2.11.8.1-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
phpMyAdmin-2.11.8.1-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
CVE-2008-3456: phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack. CVE-2008-3457: Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
Updates went to stable as: https://admin.fedoraproject.org/updates/F8/FEDORA-2008-6810 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-6868