Security phpmyadmin 4.8.4 security update release

eva2000 · Dec 13, 2018

Heads up phpmyadmin 4.8.4 security release update is out Security fix: phpMyAdmin 4.8.4 is released. If you didn't use phpmyadmin.sh addon to install phpmyadmin, and installed it manually, you'd have to update your phpmyadmin install yourself.

FYI, Centmin Mod users who use phpmyadmin.sh addon to install phpmyadmin would have an auto update cronjob scheduled to automatically update your phpmyadmin installation already

You can list your cronjobs via command
Code (Text):
crontab -l
one of them would be the following if you used phpmyadmin.sh addon to install phpmyadmin
Code (Text):
19 02 * * * /root/tools/phpmyadmin_update.sh
Security fix: phpMyAdmin 4.8.4 is released
2018-12-11

The phpMyAdmin team is pleased to announce the release of phpMyAdmin version 4.8.4. Among other bug fixes, this contains several important security fixes.

The security fixes involve:

Local file inclusion (Security - PMASA-2018-6),

XSRF/CSRF vulnerabilities allowing a specially-crafted URL to perform harmful operations (Security - PMASA-2018-7), and

an XSS vulnerability in the navigation tree (Security - PMASA-2018-8)

In addition to the security fixes, this release also includes these bug fixes and more as part of our regular release cycle:

Issue with changing theme

Ensure that database names with a dot ('.') are handled properly when DisableIS is true

Fix for message "Error while copying database (pma__column_info)"

Move operation causes "SELECT * FROM `undefined`" error

When logging with $cfg['AuthLog'] to syslog, successful login messages were not logged when $cfg['AuthLogSuccess'] was true

Multiple errors and regressions with Designer

And several more. Complete notes are in the ChangeLog file included with this release.

Note that for this release, we experimented with a pre-release announcement so that hosting providers and package managers would have an opportunity to prepare for the security release. If this was helpful to you or if you have feedback about this technique, please let us know through the public list developers@phpmyadmin.net or privately at security@phpmyadmin.net. We may or may not decide use this behavior in the future and your feedback will help us decide whether it's beneficial to the community.

As always, downloads are available at Downloads
Click to expand...

Log in / Register

Forums

Want to subscribe to topics you're interested in?

Security phpmyadmin 4.8.4 security update release

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

Security phpmyadmin 4.8.4 security update release

eva2000 Administrator Staff Member

.