Blogs

phpMyAdmin Multiple Script Insertion Vulnerabilities PMASA-2011-14

http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php

"Firstly, if a row contains javascript code, after inline editing this row and saving, the code is executed. Secondly, missing sanitization on the db, table and column names leads to XSS vulnerabilities."

Please respond back to this ticket if you found this security alert helpful.

Security updates available for Adobe Reader and Acrobat

http://www.adobe.com/support/security/bulletins/apsb11-24.html

"Critical vulnerabilities have been identified in Adobe Reader X (10.1) and earlier versions for Windows and Macintosh, Adobe Reader 9.4.2 and earlier versions for UNIX, and Adobe Acrobat X (10.1) and earlier versions for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system."

phpMyAdmin updates close XSS hole

http://www.h-online.com/security/news/item/phpMyAdmin-updates-close-XSS-
hole-1331093.html

"The phpMyAdmin developers have announced the release of versions 3.4.4
and 3.3.10.4 of their open source database administration tool. According
to the security advisory, these maintenance and security updates close a
hole (CVE-2011-3181) in the Tracking feature that leads to multiple
cross-site scripting (XSS) vulnerabilities."

phpMyAdmin updates close XSS hole

http://www.h-online.com/security/news/item/phpMyAdmin-updates-close-XSS-
hole-1331093.html

"The phpMyAdmin developers have announced the release of versions 3.4.4
and 3.3.10.4 of their open source database administration tool. According
to the security advisory, these maintenance and security updates close a
hole (CVE-2011-3181) in the Tracking feature that leads to multiple
cross-site scripting (XSS) vulnerabilities."

Skype Bug May Expose Users to Malicious Code

http://www.theregister.co.uk/2011/08/22/skype_security_bug/

"The XSS, or cross-site scripting, vulnerability in Skype 5.5.0.113 is
the result of the voice-over-IP client failing to inspect user-supplied
phone numbers for malicious code, researcher Levent Kayan said. As a
result, attackers might be able to exploit the bug to inject commands or
scripts that hijack the machine running the program.

PHP 5.3.8 Released

http://www.php.net/archive/2011.php#id2011-08-23-1

This release fixes two bugs:
* Fixed - crypt() returns only the salt for MD5
* Reverted a change in timeout handling restoring PHP 5.3.6 behavior,
which caused mysqlnd SSL connections to hang

The first in the list is the security alert sent out a couple of days ago
advising all to hold off on updating PHP.

Please reply back to this ticket if you found this security alert useful.

Pages