please sync phpmyadmin for intrepid with 4:2.11.8.1-5 from debian stable

[Micah Gersten]

Binary package hint: phpmyadmin

Intrepid is currently: 4:2.11.8.1-1

From the debian changelog:
  phpmyadmin (4:2.11.8.1-5) unstable; urgency=high

   * Add fix for SQL injection [PMASA-2008-10].

 -- Thijs Kinkhorst <email address hidden> Tue, 09 Dec 2008 21:15:20 +0100
phpmyadmin (4:2.11.8.1-4) unstable; urgency=high

   * Add fix for cross site scripting in pmd_pdf.php.
     [PMASA-2008-9, CVE-2008-4775]
   * Fix encoding of Norwegian from latin-1 to utf-8
     (Closes: #501735)

 -- Thijs Kinkhorst <email address hidden> Fri, 31 Oct 2008 11:34:28 +0100
phpmyadmin (4:2.11.8.1-3) unstable; urgency=high

   * Security fix: strip NUL bytes from to be sanitised strings
     to prevent cross site scripting in MSIE.
     [PMASA-2008-8, CVE-2008-4326]

 -- Thijs Kinkhorst <email address hidden> Wed, 24 Sep 2008 07:25:54 +0200
phpmyadmin (4:2.11.8.1-2) unstable; urgency=high

   * Security fix: remote code execution by authenticated users
     [CVE-2008-4096, PMASA-2008-7]
   * Disallow access to libraries dir when using lighttpd.
 -- Thijs Kinkhorst <email address hidden> Sat, 20 Sep 2008 12:22:20 +0200

[papukaija (papukaija)]

For Jaunty the 4:3.1.2-1 (universe) is already synced from Debian experimental (main). See bug 324299 for more information.

Please note that the newest in debian stable is 4:2.11.8.1-5

I suggest that this bug would be marked as fixed/confirmed and dupplicate of bug 324299.

[Micah Gersten (micahg)]

papukaija wrote:
> For Jaunty the 4:3.1.2-1 (universe) is already synced from Debian
> experimental (main). See bug 324299 for more information.
>
> Please note that the newest in debian stable is 4:2.11.8.1-5
>
> I suggest that this bug would be marked as fixed/confirmed and
> dupplicate of bug 324299.
>
>
Actually this was a request for a security sync with debian lenny.
Current Intrepid version is 2.11.8.1-1. I wanted someone to update to
the latest patch revision for that version.

Thanks,
Micah

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityUpdateProcedures

[Micah Gersten (micahg)]

Marking High per serious severity on phpmyadmin.net

[Launchpad Janitor (janitor)]

This bug was fixed in the package phpmyadmin - 4:2.11.3-1ubuntu1.2

---------------
phpmyadmin (4:2.11.3-1ubuntu1.2) hardy-security; urgency=low

  [ Jonathan Davies ]
  * SECURITY UPDATE: Insufficient output sanitizing when generating
    configuration file (LP: #387215).
    - debian/patches/053_CVE-2009-1151.dpatch: Added. Do not output unescaped
      chars to generated configuration file. Patch from upstream SVN revision
      12301.
    - References:
      + CVE-2009-1151
      + PMASA-2009-3

  [ Marc Deslauriers ]
  * SECURITY UPDATE: authorization bypass via cross-site request forgery
    - debian/patches/054_CVE-2008-3197.dpatch: use a token in index.php,
      js/querywindow.js and libraries/footer.inc.php. Use a "new_db"
      parameter in db_create.php, libraries/common.inc.php and
      libraries/display_create_database.lib.php.
    - CVE-2008-3197
  * SECURITY UPDATE: spoofing or fishing via cross-site framing attack
    (LP: #259839)
    - debian/patches/055_CVE-2008-3456.dpatch: Introduce new
      AllowThirdPartyFraming configuration boolean that allows phpMyAdmin
      to be included from a document located on another domain.
    - CVE-2008-3456
  * SECURITY UPDATE: code injection via cross-site scripting in setup.php
    (LP: #259839)
    - debian/patches/056_CVE-2008-3457.dpatch: clean $val[1] in
      scripts/setup.php.
    - CVE-2008-3457
  * SECURITY UPDATE: remote code execution via PHP sequences in sort_by
    parameter
    - debian/patches/057_CVE-2008-4096.dpatch: add new
      PMA_usort_comparison_callback in libraries/database_interface.lib.php
    - CVE-2008-4096
  * SECURITY UPDATE: cross-site scripting via NUL byte
    - debian/patches/058_CVE-2008-4326.dpatch: remove NUL bytes in
      libraries/js_escape.lib.php.
    - CVE-2008-4326
  * SECURITY UPDATE: cross-site scripting in pmd_pdf.php when
    register_globals is enabled
    - debian/patches/059_CVE-2008-4775.dpatch: use
      PMA_generate_common_hidden_inputs in pmd_pdf.php.
    - CVE-2008-4775
  * SECURITY UPDATE: code execution via CSRF vulnerability (LP: #306699)
    - debian/patches/060_CVE-2008-5621.dpatch: use PMA_backquote instead of
      PMA_sqlAddslashes in libraries/db_table_exists.lib.php.
    - CVE-2008-5621
  * SECURITY UPDATE: code injection via multiple cross-site scripting
    vulnerabilities in display_export.lib.php
    - debian/patches/061_CVE-2009-1150.dpatch: strip special chars in
      libraries/display_export.lib.php.
    - CVE-2009-1150

 -- Marc Deslauriers <email address hidden> Sun, 05 Jul 2009 11:29:29 -0400