Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 465420 (CVE-2013-1937) - <dev-db/phpmyadmin-3.5.8: XSS flaw when displaying GIS Visualization(s) (CVE-2013-1937)
Summary: <dev-db/phpmyadmin-3.5.8: XSS flaw when displaying GIS Visualization(s) (CVE-...
Status: RESOLVED FIXED
Alias: CVE-2013-1937
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Low minor
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B4 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-04-10 18:10 UTC by Agostino Sarubbo
Modified: 2013-11-04 11:57 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-04-10 18:10:27 UTC 
From ${URL} :

A cross-site scripting (XSS) flaw was found in the way phpMyAdmin, a tool to handle the administration of MySQL over the World Wide Web, sanitized certain input when 
displaying GIS visualization(s). A remote attacker could provide a specially-crafted URL that, when visited would lead to arbitrary HTML or web script execution in the 
context of the phpMyAdmin user's session.

References:
[1] http://seclists.org/fulldisclosure/2013/Apr/100

Relevant upstream patch:
[2] https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a
Comment 1 Alex Legler (RETIRED) archtester gentoo-dev Security 2013-04-18 13:21:23 UTC 
Arches, please test and mark stable:
=dev-db/phpmyadmin-3.5.8
Target keywords : "alpha amd64 hppa ppc ppc64 sparc x86"
Comment 2 Jeroen Roovers (RETIRED) gentoo-dev 2013-04-18 15:26:30 UTC 
Stable for HPPA.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2013-04-19 11:25:36 UTC 
CVE-2013-1937 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1937):
  Multiple cross-site scripting (XSS) vulnerabilities in
  tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow
  remote attackers to inject arbitrary web script or HTML via the (1)
  visualizationSettings[width] or (2) visualizationSettings[height] parameter.
Comment 4 Agostino Sarubbo gentoo-dev 2013-04-20 20:42:01 UTC 
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2013-04-20 20:47:29 UTC 
x86 stable
Comment 6 Agostino Sarubbo gentoo-dev 2013-04-22 09:04:31 UTC 
ppc stable
Comment 7 Agostino Sarubbo gentoo-dev 2013-04-22 10:10:45 UTC 
ppc64 stable
Comment 8 Agostino Sarubbo gentoo-dev 2013-04-22 12:23:50 UTC 
alpha stable
Comment 9 Agostino Sarubbo gentoo-dev 2013-04-26 09:20:27 UTC 
sparc stable
Comment 10 Alex Legler (RETIRED) archtester gentoo-dev Security 2013-08-18 00:05:01 UTC 
glsa with 467080, 478696, 479870
Comment 11 GLSAMaker/CVETool Bot gentoo-dev 2013-11-04 11:57:06 UTC 
This issue was resolved and addressed in
 GLSA 201311-02 at http://security.gentoo.org/glsa/glsa-201311-02.xml
by GLSA coordinator Sergey Popov (pinkbyte).