-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Wed, 7 Nov 2007 14:19:22 +0100 Source: phpmyadmin Binary: phpmyadmin Architecture: source all Version: 4:2.6.2-3sarge6 Distribution: oldstable-security Urgency: high Maintainer: Piotr Roszatycki <dexter@debian.org> Changed-By: Thijs Kinkhorst <thijs@debian.org> Description: phpmyadmin - set of PHP-scripts to administrate MySQL over the WWW Changes: phpmyadmin (4:2.6.2-3sarge6) oldstable-security; urgency=high . * Update for sarge to address a security issue. * Muliple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. (CVE-2007-5589, PMASA-2007-6) Files: 6f8e63669094450f8450a808deacff73 896 web extra phpmyadmin_2.6.2-3sarge6.dsc 14903fdbe6383e4fa6934e4b955851ec 42524 web extra phpmyadmin_2.6.2-3sarge6.diff.gz b1cfa31fcc29881a78269f38de1387c6 2770320 web extra phpmyadmin_2.6.2-3sarge6_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iQEVAwUBRzG95Wz0hbPcukPfAQI0Ngf+M10nW6U4BJ6GdgF11Hk8JDzQs+yIOhFe vAJEWTOYdwis9dhft+yybplYoDW3b/enDODLUVVCrVnz0+lmNNgsB4SJou2xvf9A SP8jJmri36tsn1kQnuBItqR3lTH82alEwjwZsPDamkz3RLSrYF6CI6e1vDNItATn vAAwd1QZM8OLZWmRTe4gWUwKGuLw0Aj6cjB0ig4HXQLizYQYSilkPE8YgeqxwYQk YwGLgESXjsLwy4v01gmoDniq4IeMXZrlFLWz+oekaGLoP7wSl+Ytkk3iZrItx0Kv LYB4tZjWZ+6jhBR9cbduNFSyQvpUaewSb8d4/jNNMavdc/HQWz5n2g== =tMS8 -----END PGP SIGNATURE----- Accepted: phpmyadmin_2.6.2-3sarge6.diff.gz to pool/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge6.diff.gz phpmyadmin_2.6.2-3sarge6.dsc to pool/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge6.dsc phpmyadmin_2.6.2-3sarge6_all.deb to pool/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge6_all.deb