From 59b1d88761ed98a2bd6a4ab4a68962773a473463 Mon Sep 17 00:00:00 2001 From: Roy Li Date: Thu, 30 Oct 2014 13:37:25 +0800 Subject: phpmyadmin: fix for Security Advisory CVE-2014-5273 Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5273 Signed-off-by: Roy Li Signed-off-by: Armin Kuster --- ...ug-4504-security-Self-XSS-in-query-charts.patch | 29 ++++++++++++++++++++++ .../recipes-php/phpmyadmin/phpmyadmin_4.2.7.bb | 1 + 2 files changed, 30 insertions(+) create mode 100644 meta-webserver/recipes-php/phpmyadmin/phpmyadmin/0001-bug-4504-security-Self-XSS-in-query-charts.patch diff --git a/meta-webserver/recipes-php/phpmyadmin/phpmyadmin/0001-bug-4504-security-Self-XSS-in-query-charts.patch b/meta-webserver/recipes-php/phpmyadmin/phpmyadmin/0001-bug-4504-security-Self-XSS-in-query-charts.patch new file mode 100644 index 0000000000..27eac77629 --- /dev/null +++ b/meta-webserver/recipes-php/phpmyadmin/phpmyadmin/0001-bug-4504-security-Self-XSS-in-query-charts.patch @@ -0,0 +1,29 @@ +From 90ddeecf60fc029608b972e490b735f3a65ed0cb Mon Sep 17 00:00:00 2001 +From: Madhura Jayaratne +Date: Sun, 17 Aug 2014 08:52:05 -0400 +Subject: [PATCH] bug #4504 [security] Self-XSS in query charts + +Upstream-status: Backport + +Signed-off-by: Marc Delisle +--- + js/tbl_chart.js | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + + 4.2.7.0 (2014-07-31) +diff --git a/js/tbl_chart.js b/js/tbl_chart.js +index 943d4ae..04c9c40 100644 +--- a/js/tbl_chart.js ++++ b/js/tbl_chart.js +@@ -47,7 +47,7 @@ function PMA_queryChart(data, columnNames, settings) { + }, + axes : { + xaxis : { +- label : settings.xaxisLabel ++ label : escapeHtml(settings.xaxisLabel) + }, + yaxis : { + label : settings.yaxisLabel +-- +1.7.10.4 + diff --git a/meta-webserver/recipes-php/phpmyadmin/phpmyadmin_4.2.7.bb b/meta-webserver/recipes-php/phpmyadmin/phpmyadmin_4.2.7.bb index 0de3f6d43c..c267d89621 100644 --- a/meta-webserver/recipes-php/phpmyadmin/phpmyadmin_4.2.7.bb +++ b/meta-webserver/recipes-php/phpmyadmin/phpmyadmin_4.2.7.bb @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=eb723b61539feef013de476e68b5c50a \ file://libraries/tcpdf/LICENSE.TXT;md5=5c87b66a5358ebcc495b03e0afcd342c" SRC_URI = "${SOURCEFORGE_MIRROR}/phpmyadmin/phpMyAdmin/${PV}/phpMyAdmin-${PV}-all-languages.tar.xz \ + file://0001-bug-4504-security-Self-XSS-in-query-charts.patch \ file://apache.conf" SRC_URI[md5sum] = "0dcd755450dac819f33502590c88ad29" -- cgit v1.2.3-54-g00ecf