Debian Security Advisory DSA 1403-1 (phpmyadmin)

Summary
The remote host is missing an update to phpmyadmin announced via advisory DSA 1403-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201403-1
Insight
Omer Singer of the DigiTrust Group discovered several vulnerabilities in phpMyAdmin, an application to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-5589 phpMyAdmin allows a remote attacker to inject arbitrary web script or HTML in the context of a logged in user's session (cross site scripting). CVE-2007-5386 phpMyAdmin, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string. For the old stable distribution (sarge) this problem has been fixed in version 4:2.6.2-3sarge6. For the stable distribution (etch) this problem has been fixed in version 4:2.9.1.1-6. For the unstable distribution (sid) this problem has been fixed in version 4:2.11.1.2-1. We recommend that you upgrade your phpmyadmin package.