Security bugs are reported here via bugzilla

[Ladislav Hagara <ladislav.hagara AT unob.cz>]

phpMyAdmin security announcement PMASA-2006-2
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2

Source Mage GNU/Linux Bug 11844:
http://bugs.sourcemage.org/show_bug.cgi?id=11844


Summary:
XSS vulnerabilities

Description:
1. It was possible to conduct an XSS attack with a crafted lang or theme 
parameter.
2. The db parameter was also vulnerable to an XSS attack.

Severity:
We consider these vulnerabilities to be serious.

Affected versions:
[1] All 2.8.0.x releases before 2.8.0.4 are affected, previous versions 
are not.
[2] Some releases before 2.8.0.4 are affected (2.6.2 tested vulnerable).
Solution:
Upgrade to phpMyAdmin 2.8.0.4.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2031
[2] We wish to thank Sven Vetsch/Disenchant for informing us in a 
responsible manner. His site is http://www.disenchant.ch.

For further information and in case of questions, please contact the 
phpMyAdmin team. Our website is http://www.phpmyadmin.net/.



-----

phpmyadmin should be updated to version 2.8.0.4:

# scribe update
# cast -c phpmyadmin

or

# scribe update
# sorcery queue-security
# cast --queue


--
Ladislav Hagara