Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 465420 (CVE-2013-1937)

Summary: <dev-db/phpmyadmin-3.5.8: XSS flaw when displaying GIS Visualization(s) (CVE-2013-1937)
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: minor CC: a3li, web-apps
Priority: Low    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B4 [glsa]
Package list:
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2013-04-10 18:10:27 UTC
From ${URL} :

A cross-site scripting (XSS) flaw was found in the way phpMyAdmin, a tool to handle the administration of MySQL over the World Wide Web, sanitized certain input when 
displaying GIS visualization(s). A remote attacker could provide a specially-crafted URL that, when visited would lead to arbitrary HTML or web script execution in the 
context of the phpMyAdmin user's session.


Relevant upstream patch:
Comment 1 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2013-04-18 13:21:23 UTC
Arches, please test and mark stable:
Target keywords : "alpha amd64 hppa ppc ppc64 sparc x86"
Comment 2 Jeroen Roovers gentoo-dev 2013-04-18 15:26:30 UTC
Stable for HPPA.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2013-04-19 11:25:36 UTC
CVE-2013-1937 (
  Multiple cross-site scripting (XSS) vulnerabilities in
  tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow
  remote attackers to inject arbitrary web script or HTML via the (1)
  visualizationSettings[width] or (2) visualizationSettings[height] parameter.
Comment 4 Agostino Sarubbo gentoo-dev 2013-04-20 20:42:01 UTC
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2013-04-20 20:47:29 UTC
x86 stable
Comment 6 Agostino Sarubbo gentoo-dev 2013-04-22 09:04:31 UTC
ppc stable
Comment 7 Agostino Sarubbo gentoo-dev 2013-04-22 10:10:45 UTC
ppc64 stable
Comment 8 Agostino Sarubbo gentoo-dev 2013-04-22 12:23:50 UTC
alpha stable
Comment 9 Agostino Sarubbo gentoo-dev 2013-04-26 09:20:27 UTC
sparc stable
Comment 10 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2013-08-18 00:05:01 UTC
glsa with 467080, 478696, 479870
Comment 11 GLSAMaker/CVETool Bot gentoo-dev 2013-11-04 11:57:06 UTC
This issue was resolved and addressed in
 GLSA 201311-02 at
by GLSA coordinator Sergey Popov (pinkbyte).