diff -Nru phpmyadmin-3.3.2/debian/changelog phpmyadmin-3.3.2/debian/changelog --- phpmyadmin-3.3.2/debian/changelog 2010-04-14 10:56:38.000000000 +0200 +++ phpmyadmin-3.3.2/debian/changelog 2012-01-09 16:31:57.000000000 +0100 @@ -1,3 +1,12 @@ +phpmyadmin (4:3.3.2-1ubuntu1) lucid-security; urgency=low + + * debian/patches/CVE-2010-4480.patch: + - CVE-2010-4480 + - prevents remote XSS attacks via a crafted BBcode tag containing + "@" characters + + -- Ante Karamatic Mon, 09 Jan 2012 16:29:00 +0100 + phpmyadmin (4:3.3.2-1) unstable; urgency=medium * New upstream release (closes: #577753). diff -Nru phpmyadmin-3.3.2/debian/patches/CVE-2010-4480.patch phpmyadmin-3.3.2/debian/patches/CVE-2010-4480.patch --- phpmyadmin-3.3.2/debian/patches/CVE-2010-4480.patch 1970-01-01 01:00:00.000000000 +0100 +++ phpmyadmin-3.3.2/debian/patches/CVE-2010-4480.patch 2012-01-09 16:26:25.000000000 +0100 @@ -0,0 +1,197 @@ +Index: phpmyadmin-3.3.2/error.php +=================================================================== +--- phpmyadmin-3.3.2.orig/error.php 2012-01-09 16:26:19.000000000 +0100 ++++ /dev/null 1970-01-01 00:00:00.000000000 +0000 +@@ -1,86 +0,0 @@ +- +- +- +- +- +- +- phpMyAdmin +- +- +- +- +-

phpMyAdmin -

+- +- +Index: phpmyadmin-3.3.2/libraries/common.inc.php +=================================================================== +--- phpmyadmin-3.3.2.orig/libraries/common.inc.php 2012-01-09 16:26:18.000000000 +0100 ++++ phpmyadmin-3.3.2/libraries/common.inc.php 2012-01-09 16:24:52.000000000 +0100 +@@ -325,7 +325,6 @@ + 'db_printview.php', + 'db_search.php', + //'Documentation.html', +- //'error.php', + 'export.php', + 'import.php', + //'index.php', +Index: phpmyadmin-3.3.2/libraries/core.lib.php +=================================================================== +--- phpmyadmin-3.3.2.orig/libraries/core.lib.php 2012-01-09 16:26:19.000000000 +0100 ++++ phpmyadmin-3.3.2/libraries/core.lib.php 2012-01-09 16:24:52.000000000 +0100 +@@ -261,21 +261,18 @@ + $error_message = strtr($error_message, array('
' => '[br]')); + + // Displays the error message +- // (do not use & for parameters sent by header) +- $query_params = array( +- 'lang' => $GLOBALS['available_languages'][$GLOBALS['lang']][2], +- 'dir' => $GLOBALS['text_dir'], +- 'type' => $GLOBALS['strError'], +- 'error' => $error_message, +- ); +- header('Location: ' . (defined('PMA_SETUP') ? '../' : '') . 'error.php?' +- . http_build_query($query_params, null, '&')); ++ $lang = $GLOBALS['available_languages'][$GLOBALS['lang']][1]; ++ $dir = $GLOBALS['text_dir']; ++ $type = $error_header; ++ $error = $error_message; + + // on fatal errors it cannot hurt to always delete the current session + if (isset($GLOBALS['session_name']) && isset($_COOKIE[$GLOBALS['session_name']])) { + PMA_removeCookie($GLOBALS['session_name']); + } + ++ require('./libraries/error.inc.php'); ++ + exit; + } + +Index: phpmyadmin-3.3.2/libraries/error.inc.php +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ phpmyadmin-3.3.2/libraries/error.inc.php 2012-01-09 16:24:52.000000000 +0100 +@@ -0,0 +1,57 @@ ++ ++ ++ ++ ++ ++ ++ phpMyAdmin ++ ++ ++ ++ ++

phpMyAdmin -

++ ++ ++ diff -Nru phpmyadmin-3.3.2/debian/patches/series phpmyadmin-3.3.2/debian/patches/series --- phpmyadmin-3.3.2/debian/patches/series 2010-04-14 10:31:35.000000000 +0200 +++ phpmyadmin-3.3.2/debian/patches/series 2012-01-09 16:26:39.000000000 +0100 @@ -1,3 +1,4 @@ mootools.patch debian.patch doc.patch +CVE-2010-4480.patch