openSUSE Security Update : phpMyAdmin (openSUSE-SU-2014:1069-1)

Medium Nessus Plugin ID 77432

Synopsis

The remote openSUSE host is missing a security update.

Description

This phpMyAdmin update addresses several security and non security issues :

- This is a phpMyAdmin version upgrade (bnc#892401): (From 4.1.14.3) :

- sf#4501 [security] XSS in table browse page (CVE-2014-5273)

- sf#4502 [security] Self-XSS in enum value editor (CVE-2014-5273)

- sf#4503 [security] Self-XSSes in monitor (CVE-2014-5273)

- sf#4505 [security] XSS in view operations page (CVE-2014-5274)

- sf#4504 [security] Self-XSS in query charts	(CVE-2014-5273)

- sf#4517 [security] XSS in relation view (CVE-2014-5273) (From 4.1.14.2) :

- sf#4488 [security] XSS injection due to unescaped table name (triggers)(CVE-2014-4955)

- sf#4492 [security] XSS in AJAX confirmation messages (CVE-2014-4986)

- sf#4491 [security] Missing validation for accessing User groups feature (CVE-2014-4987) (From 4.1.14.1) :

- sf#4464 [security] XSS injection due to unescaped db/table name in navigation hiding (CVE-2014-4349) (From 4.1.14.0 through 4.1.9.0) :

- Numerous non-security bugfixes are listed at https://github.com/phpmyadmin/phpmyadmin/blob/MAINT_4_1_ 14/ChangeLog

Solution

Update the affected phpMyAdmin package.

See Also

https://bugzilla.novell.com/show_bug.cgi?id=892401

https://github.com/phpmyadmin/phpmyadmin/blob/MAINT_4_1_14/ChangeLog

https://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html

Plugin Details

Severity: Medium

ID: 77432

File Name: openSUSE-2014-518.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2014/08/29

Updated: 2018/11/10

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:phpMyAdmin, cpe:/o:novell:opensuse:12.3, cpe:/o:novell:opensuse:13.1

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 2014/08/20

Reference Information

CVE: CVE-2014-4349, CVE-2014-4955, CVE-2014-4986, CVE-2014-4987, CVE-2014-5273, CVE-2014-5274