Описание
Security update for phpMyAdmin
This update for phpMyAdmin fixes the following issues:
Update to version 5.2.2:
- CVE-2025-24530: XSS in the 'Check Tables' feature (bsc#1236312).
- CVE-2025-24529: XSS in the 'Insert' tab (bsc#1236311).
- CVE-2024-2961: glibc/iconv: out-of-bounds writes when writing escape sequences (bsc#1222992).
- CVE-2023-30536: slim/psr7: improper header validation (bsc#1238159).
Список пакетов
SUSE Package Hub 15 SP6
openSUSE Leap 15.6
Ссылки
- E-Mail link for openSUSE-SU-2025:0081-1
- SUSE Security Ratings
- SUSE Bug 1222992
- SUSE Bug 1236311
- SUSE Bug 1236312
- SUSE Bug 1238159
- SUSE CVE CVE-2023-30536 page
- SUSE CVE CVE-2024-2961 page
- SUSE CVE CVE-2025-24529 page
- SUSE CVE CVE-2025-24530 page
Описание
slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service's web application firewall bans the application due to the receipt of malformed requests. The issue has been patched in version 1.6.1. There are no known workarounds to this issue. Users are advised to upgrade.
Затронутые продукты
Ссылки
- CVE-2023-30536
- SUSE Bug 1238159
Описание
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
Затронутые продукты
Ссылки
- CVE-2024-2961
- SUSE Bug 1222992
- SUSE Bug 1223019
Описание
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab.
Затронутые продукты
Ссылки
- CVE-2025-24529
- SUSE Bug 1236311
Описание
An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
Затронутые продукты
Ссылки
- CVE-2025-24530
- SUSE Bug 1236312