| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <516DAF73.50403@liquidweb.com> Date: Tue, 16 Apr 2013 16:07:15 -0400 From: Taylor Burke <jburke@...uidweb.com> To: full-disclosure@...ts.grok.org.uk Subject: Re: [ MDVSA-2013:144 ] phpmyadmin +1. We don't need to know about Mandriva's billions of vulnerable packages, it'd be best if they had their own security list. On 13-04-16 04:03 PM, yersinia wrote: > Please stop sending to fd. > > Already everyone here could tell the same no other linux distro is > using fd for this, iirc. > > Best > > > 2013/4/16, security@...driva.com <security@...driva.com>: >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> _______________________________________________________________________ >> >> Mandriva Linux Security Advisory MDVSA-2013:144 >> http://www.mandriva.com/en/support/security/ >> _______________________________________________________________________ >> >> Package : phpmyadmin >> Date : April 16, 2013 >> Affected: Business Server 1.0 >> _______________________________________________________________________ >> >> Problem Description: >> >> Multiple cross-site scripting (XSS) vulnerabilities in >> tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow >> remote attackers to inject arbitrary web script or HTML via the (1) >> visualizationSettings[width] or (2) visualizationSettings[height] >> parameter (CVE-2013-1937). >> >> This upgrade provides the latest phpmyadmin version (3.5.8) to address >> this vulnerability. >> _______________________________________________________________________ >> >> References: >> >> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1937 >> _______________________________________________________________________ >> >> Updated Packages: >> >> Mandriva Business Server 1/X86_64: >> 929b248f9b33fbf73022a491e48b88f4 >> mbs1/x86_64/phpmyadmin-3.5.8-0.1.mbs1.noarch.rpm >> 9cc9136cc4280dd3d3904708be166076 >> mbs1/SRPMS/phpmyadmin-3.5.8-0.1.mbs1.src.rpm >> _______________________________________________________________________ >> >> To upgrade automatically use MandrivaUpdate or urpmi. The verification >> of md5 checksums and GPG signatures is performed automatically for you. >> >> All packages are signed by Mandriva for security. You can obtain the >> GPG public key of the Mandriva Security Team by executing: >> >> gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 >> >> You can view other update advisories for Mandriva Linux at: >> >> http://www.mandriva.com/en/support/security/advisories/ >> >> If you want to report vulnerabilities, please contact >> >> security_(at)_mandriva.com >> _______________________________________________________________________ >> >> Type Bits/KeyID Date User ID >> pub 1024D/22458A98 2000-07-10 Mandriva Security Team >> <security*mandriva.com> >> -----BEGIN PGP SIGNATURE----- >> Version: GnuPG v1.4.12 (GNU/Linux) >> >> iD8DBQFRbValmqjQ0CJFipgRAgRgAJ94hPso/CAax5T5r1qt6jZsbhsDUACg58On >> nyHMhbLL0/Ai6NaXBkFQvyw= >> =6tQS >> -----END PGP SIGNATURE----- >> >> _______________________________________________ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ >> -- Regards, Taylor Burke /* * Taylor Burke * Linux Systems Administrator * * Liquid Web, Inc. - www.Liquidweb.com * support@...uidweb.com * Knowledge Base: http://kb.liquidweb.com/ * * 800-580-4985 Toll-Free - 517-322-0434 Int. */ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists