From secunia: (http://secunia.com/advisories/33014/) DESCRIPTION:Dun has discovered a vulnerability in phpPgAdmin, which can be exploited by malicious people to disclose sensitive information. Input passed via the "_language" parameter to libraries/lib.inc.php is not properly sanitised before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes. Successful exploitation of this vulnerability requires that "register_globals" is enabled. This vulnerability is confirmed in version 4.2.1. Other versions may also be affected. SOLUTION: Edit the source code to ensure that input is properly verified. PROVIDED AND/OR DISCOVERED BY: dun ORIGINAL ADVISORY: http://milw0rm.com/exploits/7363 In the default configuration "register_globals" is set to off on gentoo systems, so only specific configurations are affected.
Very low impact, so rating C4.
This is now assigned CVE-2008-5587
CVE-2008-5587 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5587): Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the _language parameter to index.php.
*** Bug 252762 has been marked as a duplicate of this bug. ***
Removed dev-db/phppgadmin-4.2.1, added 4.2.2. Targets: amd64 hppa ppc sparc x86
ppc stable
sparc stable
x86 stable
Stable for HPPA.
amd64 stable, all arches done.
Thanks everyone. C4 -> noglsa
