MGASA-2019-0200 - Updated phpmyadmin packages fix security vulnerabilities

Publication date: 21 Jun 2019
URL: https://advisories.mageia.org/MGASA-2019-0200.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2019-11768,
     CVE-2019-12616

Updated phpmyadmin packages fix security vulnerabilities:

A vulnerability was reported where a specially crafted database name can
be used to trigger an SQL injection attack through the designer feature.
(CVE-2019-11768, PMASA-2019-3)

A vulnerability was found that allows an attacker to trigger a CSRF attack
against a phpMyAdmin user. The attacker can trick the user, for instance
through a broken  tag pointing at the victim's phpMyAdmin database,
and the attacker can potentially deliver a payload (such as a specific
INSERT or DELETE statement) through the victim. (CVE-2019-12616,
PMASA-2019-4)

References:
- https://bugs.mageia.org/show_bug.cgi?id=24905
- https://www.phpmyadmin.net/security/PMASA-2019-3/
- https://www.phpmyadmin.net/security/PMASA-2019-4/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11768
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12616

SRPMS:
- 6/core/phpmyadmin-4.7.8-5.mga6