Bugzilla – Bug 951960
VUL-1: CVE-2015-7873 phpMyAdmin: Content spoofing on url.php (PMASA-2015-5)
Last modified: 2015-11-08 00:17:40 UTC
Announcement-ID: PMASA-2015-5 Date: 2015-10-23 Summary: Content spoofing vulnerability when redirecting user to an external site Description: This vulnerability allows an attacker to perform a content spoofing attack using the phpMyAdmin's redirection mechanism to external sites. Severity: We consider this vulnerability to be non critical since the spoofed content is escaped and no HTML injection is possible. Affected Versions: Versions 4.4.x (prior to 4.4.15.1) and 4.5.x (prior to 4.5.1) are affected. Solution: Upgrade to phpMyAdmin 4.4.15.1 or newer, or 4.5.1 or newer or apply patch listed below. References Thanks to Lalith Rallabhandi for reporting this vulnerability. Assigned CVE ids: 2015-7873 CWE ids: CWE-661 CWE-20 Patches The following commits have been made on the 4.4 branch to fix this issue: 2b31866fe0b30b867aaf5b5fedb11adb354e037f The following commits have been made on the 4.5 branch to fix this issue: cd097656758f981f80fb9029c7d6b4294582b706 server:php:applications/phpMyAdmin openSUSE:13.1:Update/phpMyAdmin openSUSE:13.1:Update/phpMyAdmin Tumbleweed and Leap 42.1 all at 4.4.15 all affected. References: https://bugzilla.redhat.com/show_bug.cgi?id=1275108 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7873
Fixed. Also request to Factory.
13.1, 13.2 and Leap are still affected.
Thanks for fixing the devel package and Factory/Tumbleweed. Can you confirm if you are able to make a maintenance submission for the versions maintained in 13.1 and 13.2? https://en.opensuse.org/openSUSE:Package_maintenance
Okay. I have done maintenance submission to 13.1 and 13.2. Also to Leap 42.1. Hope it's worked.
This is an autogenerated message for OBS integration: This bug (951960) was mentioned in https://build.opensuse.org/request/show/341559 13.1 / phpMyAdmin https://build.opensuse.org/request/show/341560 13.2 / phpMyAdmin https://build.opensuse.org/request/show/341561 Leap:42.1 / phpMyAdmin
openSUSE-SU-2015:1929-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 951960 CVE References: CVE-2015-7873 Sources used: openSUSE 13.2 (src): phpMyAdmin-4.4.15.1-17.1 openSUSE 13.1 (src): phpMyAdmin-4.4.15.1-37.1
openSUSE-SU-2015:1930-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 951960 CVE References: CVE-2015-7873 Sources used: openSUSE Leap 42.1 (src): phpMyAdmin-4.4.15.1-3.1
Packages now in repos. So i think i can close this bug.