stable

phpMyAdmin-4.5.4-1.fc22

FEDORA-2016-e1fe01e96e created by robert 9 years ago for Fedora 22

phpMyAdmin 4.5.4 (2016-01-28)

live data edit of big sets is not working
Table list not saved in db QBE bookmarked search
While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword
Avoid syntax error in javascript messages on invalid PHP setting for max_input_vars
Properly handle errors in upacking zip archive
Set PHP's internal encoding to UTF-8
Fixed Kanji encoding in some specific cases
Check whether iconv works before using it
Avoid conversion of MySQL error messages
Undefined index: parameters
Undefined index: field_name_orig
Undefined index: host
'Add to central columns' (per column button) does nothing
SQL duplicate entry error trying to INSERT in designer_settings table
Fix handling of databases with dot in a name
Fix hiding of page content behind menu
FROM clause not generated after loading search bookmark
Fix creating/editing VIEW with DEFINER containing special chars
Do not invoke FLUSH PRIVILEGES when server in --skip-grant-tables
Misleading message for configuration storage
Table pagination does nothing when session expired
Index comments not working properly
Better handle local storage errors
Improve detection of privileges for privilege adjusting
Undefined property: stdClass::$releases at version check when disabled in config
SQL comment and variable stripped from bookmark on save
Gracefully handle errors in regex based javascript search
[Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1
[Security] Unsafe generation of CSRF token, see PMASA-2016-2
[Security] Multiple XSS vulnerabilities, see PMASA-2016-3
[Security] Insecure password generation in JavaScript, see PMASA-2016-4
[Security] Unsafe comparison of CSRF token, see PMASA-2016-5
[Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6
[Security] XSS vulnerability in normalization page, see PMASA-2016-7
[Security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8
[Security] XSS vulnerability in SQL editor, see PMASA-2016-9

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2016-e1fe01e96e

This update has been submitted for testing by robert.

9 years ago

flo commented & provided feedback 9 years ago

karma

looks fine for me

robert edited this update.

9 years ago

This update has been pushed to testing.

9 years ago

This update has been submitted for stable by bodhi.

9 years ago

This update has been pushed to stable.

9 years ago

Please login to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

None

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

9 years ago

in testing

9 years ago

in stable

9 years ago

modified

9 years ago

Builds

phpMyAdmin-4.5.4-1.fc22

BZ#1302676 CVE-2016-2038 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-1)

BZ#1302677 CVE-2016-2039 phpMyAdmin: Unsafe generation of XSRF/CSRF token (PMASA-2016-2)

BZ#1302679 CVE-2016-2040 phpMyAdmin: Multiple XSS vulnerabilities (PMASA-2016-3)

BZ#1302680 CVE-2016-1927 phpMyAdmin: Insecure password generation in JavaScript (PMASA-2016-4)

BZ#1302681 CVE-2016-2041 phpMyAdmin: Unsafe comparison of XSRF/CSRF token (PMASA-2016-5)

BZ#1302682 CVE-2016-2042 phpMyAdmin: Multiple full path disclosure vulnerabilities (PMASA-2016-6)

BZ#1302684 CVE-2016-2043 phpMyAdmin: XSS vulnerability in normalization page (PMASA-2016-7)

BZ#1302685 CVE-2016-2044 phpMyAdmin: Full path disclosure vulnerability in SQL parser (PMASA-2016-8)

BZ#1302686 CVE-2016-2045 phpMyAdmin: XSS vulnerability in SQL editor (PMASA-2016-9)

BZ#1302790 CVE-2016-2038 CVE-2016-2039 CVE-2016-2040 CVE-2016-1927 CVE-2016-2041 CVE-2016-2043 CVE-2016-2044 CVE-2016-2045 phpmyadmin: various flaws [fedora-all]

phpMyAdmin-4.5.4-1.fc22

Automated Test Results

None