ALT-BU-2014-2906-2
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2025-04-12
CVE-2014-2665
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000145.html
- http://openwall.com/lists/oss-security/2014/03/28/1
- http://openwall.com/lists/oss-security/2014/04/01/7
- https://bugzilla.wikimedia.org/show_bug.cgi?id=62497
- https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000145.html
- http://openwall.com/lists/oss-security/2014/03/28/1
- http://openwall.com/lists/oss-security/2014/04/01/7
- https://bugzilla.wikimedia.org/show_bug.cgi?id=62497
- https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php
Modified: 2025-04-12
CVE-2014-2853
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-April/000149.html
- http://secunia.com/advisories/58262
- http://www.securityfocus.com/bid/67068
- http://www.securitytracker.com/id/1030161
- https://bugzilla.redhat.com/show_bug.cgi?id=1091967
- https://bugzilla.wikimedia.org/show_bug.cgi?id=63251
- https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6
- https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8
- https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-April/000149.html
- http://secunia.com/advisories/58262
- http://www.securityfocus.com/bid/67068
- http://www.securitytracker.com/id/1030161
- https://bugzilla.redhat.com/show_bug.cgi?id=1091967
- https://bugzilla.wikimedia.org/show_bug.cgi?id=63251
- https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6
- https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8
- https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5
Modified: 2025-04-12
CVE-2014-3966
Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-May/000151.html
- http://secunia.com/advisories/58834
- http://secunia.com/advisories/58896
- http://www.debian.org/security/2014/dsa-2957
- http://www.openwall.com/lists/oss-security/2014/06/04/15
- http://www.securityfocus.com/bid/67787
- http://www.securitytracker.com/id/1030364
- https://bugzilla.wikimedia.org/show_bug.cgi?id=65501
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-May/000151.html
- http://secunia.com/advisories/58834
- http://secunia.com/advisories/58896
- http://www.debian.org/security/2014/dsa-2957
- http://www.openwall.com/lists/oss-security/2014/06/04/15
- http://www.securityfocus.com/bid/67787
- http://www.securitytracker.com/id/1030364
- https://bugzilla.wikimedia.org/show_bug.cgi?id=65501
Modified: 2024-11-02
GHSA-6h86-9r5g-f2h5
Cross-site scripting vulnerability in includes/actions/InfoAction.php
- https://nvd.nist.gov/vuln/detail/CVE-2014-2853
- https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6
- https://bugzilla.redhat.com/show_bug.cgi?id=1091967
- https://bugzilla.wikimedia.org/show_bug.cgi?id=63251
- https://github.com/wikimedia/mediawiki
- https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8
- https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-April/000149.html
- http://secunia.com/advisories/58262
- http://www.securityfocus.com/bid/67068
- http://www.securitytracker.com/id/1030161
Package NetworkManager updated to version 0.9.10.0-alt1 for branch sisyphus in task 126073.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2006-7246
NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
- http://www.openwall.com/lists/oss-security/2010/04/22/2
- https://bugzilla.gnome.org/show_bug.cgi?id=341323
- https://bugzilla.novell.com/show_bug.cgi?id=574266
- https://lwn.net/Articles/468868/
- http://www.openwall.com/lists/oss-security/2010/04/22/2
- https://bugzilla.gnome.org/show_bug.cgi?id=341323
- https://bugzilla.novell.com/show_bug.cgi?id=574266
- https://lwn.net/Articles/468868/
Package phpMyAdmin updated to version 4.2.6-alt1 for branch sisyphus in task 126146.
Closed vulnerabilities
Modified: 2025-04-12
CVE-2014-4349
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
- http://phpmyadmin.net/home_page/security/PMASA-2014-3.php
- http://secunia.com/advisories/60397
- http://www.securityfocus.com/bid/68205
- https://github.com/phpmyadmin/phpmyadmin/commit/d4f754c937f9e2c0beadff5b2e38215dde1d6a79
- https://github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
- http://phpmyadmin.net/home_page/security/PMASA-2014-3.php
- http://secunia.com/advisories/60397
- http://www.securityfocus.com/bid/68205
- https://github.com/phpmyadmin/phpmyadmin/commit/d4f754c937f9e2c0beadff5b2e38215dde1d6a79
- https://github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be
Modified: 2025-04-12
CVE-2014-4955
Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page.
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
- http://secunia.com/advisories/60397
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php
- http://www.securityfocus.com/bid/68799
- https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
- http://secunia.com/advisories/60397
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php
- http://www.securityfocus.com/bid/68799
- https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1
Modified: 2025-04-12
CVE-2014-4986
Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message.
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
- http://secunia.com/advisories/60397
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php
- http://www.securityfocus.com/bid/68803
- https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d
- https://security.gentoo.org/glsa/201505-03
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
- http://secunia.com/advisories/60397
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php
- http://www.securityfocus.com/bid/68803
- https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d
- https://security.gentoo.org/glsa/201505-03
Modified: 2025-04-12
CVE-2014-4987
server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request.
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
- http://secunia.com/advisories/60397
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php
- http://www.securityfocus.com/bid/68804
- https://github.com/phpmyadmin/phpmyadmin/commit/395265e9937beb21134626c01a21f44b28e712e5
- https://security.gentoo.org/glsa/201505-03
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
- http://secunia.com/advisories/60397
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php
- http://www.securityfocus.com/bid/68804
- https://github.com/phpmyadmin/phpmyadmin/commit/395265e9937beb21134626c01a21f44b28e712e5
- https://security.gentoo.org/glsa/201505-03
Modified: 2025-04-12
CVE-2014-6300
Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php
- http://www.securityfocus.com/bid/69790
- https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac
- https://security.gentoo.org/glsa/201505-03
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php
- http://www.securityfocus.com/bid/69790
- https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac
- https://security.gentoo.org/glsa/201505-03
Modified: 2025-04-12
CVE-2014-7217
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php.
- http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html
- http://secunia.com/advisories/61777
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php
- http://www.securityfocus.com/bid/70252
- https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448
- https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961
- http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html
- http://secunia.com/advisories/61777
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php
- http://www.securityfocus.com/bid/70252
- https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448
- https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961
Modified: 2023-08-16
GHSA-6wfj-2mw7-p5cg
phpMyAdmin micro history Implementation XSS Vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2014-6300
- https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac
- https://security.gentoo.org/glsa/201505-03
- https://web.archive.org/web/20200228081340/http://www.securityfocus.com/bid/69790
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php
Modified: 2023-08-17
GHSA-jqmr-wqgp-8mh2
phpMyAdmin cross-site scripting Vulnerability in Table or Column Names
- https://nvd.nist.gov/vuln/detail/CVE-2014-4986
- https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d
- https://security.gentoo.org/glsa/201505-03
- https://web.archive.org/web/20200228081340/http://www.securityfocus.com/bid/68803
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php
Modified: 2023-08-17
GHSA-wv8g-fx9j-q2jg
phpMyAdmin cross-site scripting Vulnerability via ENUM value
- https://nvd.nist.gov/vuln/detail/CVE-2014-7217
- https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448
- https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961
- https://web.archive.org/web/20141010205819/http://www.securityfocus.com/bid/70252
- http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php