Package: phpmyadmin Version: 4:2.11.8.1-5+lenny1 Severity: critical Tags: security Justification: root security hole Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted MySQL table name. SQL injection vulnerability allows remote attackers to inject SQL via various interface parameters of the PDF schema generator feature. Assigned CVE ids: CVE-2009-3696 CVE-2009-3697 For more clarity: http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php -- System Information: Debian Release: 5.0.3 APT prefers stable APT policy: (500, ''stable'') Architecture: amd64 (x86_64) Kernel: Linux 2.6.26-2-amd64 (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages phpmyadmin depends on: ii debconf [debconf-2 1.5.24 Debian configuration management sy ii libapache2-mod-php 5.2.6.dfsg.1-1+lenny3 server-side, HTML-embedded scripti ii perl 5.10.0-19lenny2 Larry Wall''s Practical Extraction ii php5-mcrypt 5.2.6.dfsg.1-1+lenny3 MCrypt module for php5 ii php5-mysql 5.2.6.dfsg.1-1+lenny3 MySQL module for php5 Versions of packages phpmyadmin recommends: ii apache2-mpm-prefor 2.2.9-10+lenny4 Apache HTTP Server - traditional n ii php5-gd 5.2.6.dfsg.1-1+lenny3 GD module for php5 Versions of packages phpmyadmin suggests: ii mysql-server 5.0.51a-24+lenny2 MySQL database server (metapackage ii mysql-server-5.0 [mysq 5.0.51a-24+lenny2 MySQL database server binaries -- debconf information excluded