~ubuntu-branches/ubuntu/hardy/phpmyadmin/hardy-updates : changes

~ubuntu-branches/ubuntu/hardy/phpmyadmin/hardy-updates » Changes from revision 29

From Revision 29 to 10

Rev	Summary	Authors	Tags	Date
29	* SECURITY UPDATE: XSS via a crafted name for a MySQL table ... * SECURITY UPDATE: XSS via a crafted name for a MySQL table (LP: #450505) - debian/patches/062_CVE-2009-3696-3697.dpatch: filter special characters in db_operations.php. - CVE-2009-3696 * SECURITY UPDATE: SQL injection via PDF schema generator functionality (LP: #450505) - debian/patches/062_CVE-2009-3696-3697.dpatch: filter and escape special characters in pdf_pages.php and pmd_pdf.php. - CVE-2009-3697	Marc Deslauriers	4:2.11.3-1ubuntu1.3	14 years ago
28	[ Jonathan Davies ] [ Jonathan Davies ] * SECURITY UPDATE: Insufficient output sanitizing when generating configuration file (LP: #387215). - debian/patches/053_CVE-2009-1151.dpatch: Added. Do not output unescaped chars to generated configuration file. Patch from upstream SVN revision 12301. - References: + CVE-2009-1151 + PMASA-2009-3 [ Marc Deslauriers ] * SECURITY UPDATE: authorization bypass via cross-site request forgery - debian/patches/054_CVE-2008-3197.dpatch: use a token in index.php, js/querywindow.js and libraries/footer.inc.php. Use a "new_db" parameter in db_create.php, libraries/common.inc.php and libraries/display_create_database.lib.php. - CVE-2008-3197 * SECURITY UPDATE: spoofing or fishing via cross-site framing attack (LP: #259839) - debian/patches/055_CVE-2008-3456.dpatch: Introduce new AllowThirdPartyFraming configuration boolean that allows phpMyAdmin to be included from a document located on another domain. - CVE-2008-3456 * SECURITY UPDATE: code injection via cross-site scripting in setup.php (LP: #259839) - debian/patches/056_CVE-2008-3457.dpatch: clean $val[1] in scripts/setup.php. - CVE-2008-3457 * SECURITY UPDATE: remote code execution via PHP sequences in sort_by parameter - debian/patches/057_CVE-2008-4096.dpatch: add new PMA_usort_comparison_callback in libraries/database_interface.lib.php - CVE-2008-4096 * SECURITY UPDATE: cross-site scripting via NUL byte - debian/patches/058_CVE-2008-4326.dpatch: remove NUL bytes in libraries/js_escape.lib.php. - CVE-2008-4326 * SECURITY UPDATE: cross-site scripting in pmd_pdf.php when register_globals is enabled - debian/patches/059_CVE-2008-4775.dpatch: use PMA_generate_common_hidden_inputs in pmd_pdf.php. - CVE-2008-4775 * SECURITY UPDATE: code execution via CSRF vulnerability (LP: #306699) - debian/patches/060_CVE-2008-5621.dpatch: use PMA_backquote instead of PMA_sqlAddslashes in libraries/db_table_exists.lib.php. - CVE-2008-5621 * SECURITY UPDATE: code injection via multiple cross-site scripting vulnerabilities in display_export.lib.php - debian/patches/061_CVE-2009-1150.dpatch: strip special chars in libraries/display_export.lib.php. - CVE-2009-1150	Marc Deslauriers	4:2.11.3-1ubuntu1.2	14 years ago
27	* SECURITY UPDATE: sensitive data in session files, reading ... * SECURITY UPDATE: sensitive data in session files, reading of arbitrary files by users with the CREATE privilege. (LP: #227283) - debian/patches/051_CVE-2008-1567.dpatch: Add. Don't save sensitive information in session files. Patch from upstream SVN. - debian/patches/052_CVE-2008-1924.dpatch: Add. Confirm that the upload directory is set. Patch from upstream SVN. - References: + CVE-2008-1567 + CVE-2008-1924 + PMASA-2008-2 + PMASA-2008-3	William Grant	4:2.11.3-1ubuntu1.1	15 years ago
26	* SECURITY UPDATE: * SECURITY UPDATE: + debian/patches/050_CVE-2008-1149.dpatch - Provides unauthorized access, Allows partial confidentiality, integrity, and availability violation , Allows unauthorized disclosure of information , Allows disruption of service. (LP: #198745) * References: + http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1149 + http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1 * debian/control: + updated maintainer field	Emanuele Gentili	4:2.11.3-1ubuntu1	16 years ago
25	New upstream release. New upstream release.	Thijs Kinkhorst	4:2.11.3-1	16 years ago
24	* New upstream release. * New upstream release. * Fixes cross site scripting issue (PMASA-2007-8).	Thijs Kinkhorst	4:2.11.2.2-1	16 years ago
23	* New upstream release. * New upstream release. * Fixes unimportant "security" issue: XSS/SQL injection through database names (PMASA-2007-7).	Thijs Kinkhorst	4:2.11.2.1-1	16 years ago
22	* Fixed typo in postrm script which broke removal (Closes: #... * Fixed typo in postrm script which broke removal (Closes: #448653). * Added support for configuring lighttpd web server. * Drop build dependency on perl and replace it by sed.	Michal Čihař	4:2.11.2-2	16 years ago
21	* New upstream release. * New upstream release. * Addresses two cross site scripting issues: PMASA-2007-5, PMASA-2007-6 (CVE-2007-5386, closes: #446451)	Thijs Kinkhorst	4:2.11.1.2-1	16 years ago
20	* New upstream bugfix release. * New upstream bugfix release. [ Translations ] * German by Helge Kreutzmann (Closes: #432566).	Thijs Kinkhorst	4:2.10.3-1	16 years ago
19	Added missing favicon.ico (Closes: LP #124402). Added missing favicon.ico (Closes: LP #124402).	Chuck Short	4:2.10.2-1ubuntu1	16 years ago
18	[ Thijs Kinkhorst ] [ Thijs Kinkhorst ] * New upstream release. * Welcome Michal Čihař as new co-maintainer. [ Translations ] * Vietnamese by Clytie Siddall (Closes: #427177).	Thijs Kinkhorst	4:2.10.2-1	16 years ago
17	[ Thijs Kinkhorst ] [ Thijs Kinkhorst ] * php5-mcrypt is now a dependency on 64 bit platforms. Move it from Recommends to Depends because it's not possible to specify per-arch dependencies, and it's also very useful to have on 32 bit platforms because of the speed increase (Closes: #425164). [ Translations ] * French by Chrisian Perrier (Closes: #423954). * Danish by Claus Hindsgaul (Closes: #426786).	Thijs Kinkhorst	4:2.10.1-3	16 years ago
16	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - Depends on php5-mcrypt to fix access on AMD64 machines - Update maintainer field in debian/package	Luca Falavigna	4:2.10.1-2ubuntu1	16 years ago
15	* Depends on php5-mcrypt to fix access on AMD64 machines (LP... * Depends on php5-mcrypt to fix access on AMD64 machines (LP: 114044) * Remove PHP 4 dependencies * Update maintainer field in debian/packages	Luca Falavigna	4:2.9.1.1-2ubuntu2	16 years ago
14	* SECURITY: Fix PHP Executor Deep Recursion Stack Overflow * SECURITY: Fix PHP Executor Deep Recursion Stack Overflow * References: http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-3 https://bugs.launchpad.net/ubuntu/+source/phpmyadmin/+bug/94891 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1325	Martin Jürgens	4:2.9.1.1-2ubuntu1	17 years ago
13	* Backport security-related changes from 2.9.2-rc1: * Backport security-related changes from 2.9.2-rc1: * CVE-2007-0203: Multiple unspecified vulnerabilities; this turns out to be (1) cross site scripting and (2) the same as CVE-2006-6374. (Closes: #406332, #406486) * CVE-2006-6374: the vulnerability only applies to PHP < 5.1.2 and < 4.4.2, so strictly speaking current Debian is not vulnerable. Include it anyway, to not expose those using older PHP versions. (Closes: #404744)	Thijs Kinkhorst	4:2.9.1.1-2	17 years ago
12	* New upstream release. * New upstream release. - Addresses several security issues (Closes: #399329). * In Depends, explicitly prefer the apache2/apache PHP module, to make sure the correct one is selected upon installation. * Drop 100-dutch_fixtypo.patch, integrated upstream. * Add note to default config file about adding sensitive data to that file (Closes: #321529). * Update README.Debian with information about register_globals.	Thijs Kinkhorst	4:2.9.1.1-1	17 years ago
11	* New upstream bugfix release. * New upstream bugfix release. - Includes a fix for a XSS security issue (PMASA-2006-6). (Closes: #396638) * 100-dutch_fixtypo.patch: Add patch to fix typo in Dutch translation which also caused a layout problem in the login screen. * 021-config.inc.php_no_check_mtime.patch: Add patch to Config class to disable checking for the mtime of config.inc.php. Since we include other files from it, those will otherwise never be read (Closes: #392022). * Add depends on perl since it's used in the maintainer scripts. * Update shipped htaccess to make it compatible with Apache 2.2 (Closes: #396560). * Updated translations: - Bokmål by Bjørn Steensrud. - Basque by Piarres Beobide. - Dutch by self. - Danish by Claus Hindsgaul (Closes: #393871). - Japanese by Hideki Yamane (Closes: #396548).	Thijs Kinkhorst	4:2.9.0.3-1	17 years ago
10	* Non-maintainer upload. * Non-maintainer upload. * Fix issue with /var/www pointing to /usr/share/phpmyadmin. (Closes: #385889) * Make sure we install /var/www as a directory, since we make a symlink into it and we can't rely on it being there. * Explicitly link to /var/www/phpmyadmin instead of /var/www, to make sure we don't make a new /var/www even if it should be removed for some reason.	Steinar H. Gunderson	4:2.8.2-0.2	17 years ago

Older »