-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 17 Aug 2016 10:05:21 +0200 Source: phpmyadmin Binary: phpmyadmin Architecture: source all Version: 4:4.6.4+dfsg1-1 Distribution: unstable Urgency: high Maintainer: Thijs Kinkhorst <thijs@debian.org> Changed-By: Michal Čihař <nijel@debian.org> Description: phpmyadmin - MySQL web administration tool Changes: phpmyadmin (4:4.6.4+dfsg1-1) unstable; urgency=high . * Repacked sources to exclude non free sRGB profile. * Replace FollowSymLinks with SymLinksIfOwnerMatch to apache configuration. * Updated Chinese debconf translations. * Better generate blowfish_secret. * New upstream release, fixing several security issues: - Weaknesses with cookie encryption (PMASA-2016-29, CVE-2016-6606) - Multiple XSS vulnerabilities (PMASA-2016-30, CVE-2016-6607) - Multiple XSS vulnerabilities (PMASA-2016-31, CVE-2016-6608) - PHP code injection (PMASA-2016-32, CVE-2016-6609) - Full path disclosure (PMASA-2016-33, CVE-2016-6610) - SQL injection attack (PMASA-2016-34, CVE-2016-6611) - Local file exposure through LOAD DATA LOCAL INFILE (PMASA-2016-35, CVE-2016-6612) - Local file exposure through symlinks with UploadDir (PMASA-2016-36, CVE-2016-6613) - Path traversal with SaveDir and UploadDir (PMASA-2016-37, CVE-2016-6614) - Multiple XSS vulnerabilities (PMASA-2016-38, CVE-2016-6615) - SQL injection vulnerability as control user (PMASA-2016-39, CVE-2016-6616) - SQL injection vulnerability (PMASA-2016-40, CVE-2016-6617) - Denial-of-service attack through transformation feature (PMASA-2016-41, CVE-2016-6618) - SQL injection vulnerability as control user (PMASA-2016-42, CVE-2016-6619) - Verify data before unserializing (PMASA-2016-43, CVE-2016-6620) - SSRF in setup script (PMASA-2016-44, CVE-2016-6621) - Denial-of-service attack with $cfg['AllowArbitraryServer'] = true and persistent connections (PMASA-2016-45, CVE-2016-6622) - Denial-of-service attack by using for loops (PMASA-2016-46, CVE-2016-6623) - Possible circumvention of IP-based allow/deny rules with IPv6 and proxy server (PMASA-2016-47, CVE-2016-6624) - Detect if user is logged in (PMASA-2016-48, CVE-2016-6625) - Bypass URL redirection protection (PMASA-2016-49, CVE-2016-6626) - Referrer leak (PMASA-2016-50, CVE-2016-6627) - Reflected File Download (PMASA-2016-51, CVE-2016-6628) - ArbitraryServerRegexp bypass (PMASA-2016-52, CVE-2016-6629) - Denial-of-service attack by entering long password (PMASA-2016-53, CVE-2016-6630) - Remote code execution vulnerability when running as CGI (PMASA-2016-54, CVE-2016-6631) - Denial-of-service attack when PHP uses dbase extension (PMASA-2016-55, CVE-2016-6632) - Remove tode execution vulnerability when PHP uses dbase extension (PMASA-2016-56, CVE-2016-6633) Checksums-Sha1: 5b146f0d37a0fe6c8631235d185b9e0667d6800c 1943 phpmyadmin_4.6.4+dfsg1-1.dsc 46ada4875a977e9d3fc17fb63908ea0500182fb9 6224348 phpmyadmin_4.6.4+dfsg1.orig.tar.xz 60b52e26f7f5da8842408e42b50fe2d036390a25 78764 phpmyadmin_4.6.4+dfsg1-1.debian.tar.xz 539816c15ea36ec37cc35e2b6145ed060d71479d 3870594 phpmyadmin_4.6.4+dfsg1-1_all.deb Checksums-Sha256: b0a70dd4d8d9626c8f0dc201aeb22849e4437679d875234a9a1482497cd54e8d 1943 phpmyadmin_4.6.4+dfsg1-1.dsc 9397b1e53e0fc070827707845ae45d37af67fe85f840a1d898f69518d9b29070 6224348 phpmyadmin_4.6.4+dfsg1.orig.tar.xz f804b8304dfb54a6e000f3ab64f2d518586150994bd658f720bb71cc29b2b46d 78764 phpmyadmin_4.6.4+dfsg1-1.debian.tar.xz 4733cd267c629805b2b2d630c7d33fad7035e468c7314b3c505a9e81cf34dd21 3870594 phpmyadmin_4.6.4+dfsg1-1_all.deb Files: aea5aec1eac43648607be034bec29310 1943 web extra phpmyadmin_4.6.4+dfsg1-1.dsc ab4b4c687d2e61bd17c37979e8e402ec 6224348 web extra phpmyadmin_4.6.4+dfsg1.orig.tar.xz 3d270735caeb5473d621b674c5d715bc 78764 web extra phpmyadmin_4.6.4+dfsg1-1.debian.tar.xz 52609e12303c3d9630c8a1bba943cdf9 3870594 web extra phpmyadmin_4.6.4+dfsg1-1_all.deb -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJXtBtSAAoJEPSqIp1NWMJFMk4P/05RB/n8HuQOgMe0kHjwxr7h Wp0j8o8hqspFIVBtzxCLVE3/c4I46WvGnsatPWmT+8oerKa/Kd50/80kgsT3yq2J ZNZdGDhkr9NhgA0N+r5ITyBuKfLkdXHYzHL2RzjEcz+Y/OtpAQSCCUcL8uxGXPir T1VvfuMg5yZj40sl4u41jGevTcoGUGLdqPBLugL+pMusIVettL9CFw7NtJSDO9WR 0em6oIUr7/udDbBcQL9b6l7AcBqonfT9zU4IdDBRBxvdg8xxvZapeNdZD3bno3N4 N/u1gc6UT5lk7pBDzLqugLpHvzol9lfvLEF4YdX3aSEWgFSNtDn4YlrT20hBxLp0 I3x4PwNP1tWaUHfPbeXNO0UGlmskyGWWIUfoBPjmVMXYMPl4YjuPgPrwMy3jwrtj Gdnvoewowl4mk0JwXdeXA9snhLiE3H4GUhlsO6mvmnCQdj2C1hq8uLgH6MPo3IKj 1tZGpXTpy5aWTdJVkU8KMI1Ls5JW/sTiHcKivJUdWFCllaSCMfod7Tn4kbBPvu6m UzAs9MLBDAK3MwhrkEeTAaijuWYbnvK/mRiSJZDdnPKVNspnvrwnhPxzhDmVM0dK SS/FUvUgIh8wHDbv/nFeeiaFHcX67odHUO21lGZodEglnonN0b7wGAwsr06evnxZ lMn7kwOphzm17O9Zpymo =xKqt -----END PGP SIGNATURE-----