Description
phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 4:2.11.8~rc1-1 | — |
| Debian 13 | phpmyadmin | 4:2.11.8~rc1-1 | — |
| Debian 12 | phpmyadmin | 4:2.11.8~rc1-1 | — |
| Debian 4.0 | phpmyadmin | 4:2.9.1.1-8 | DSA-1641-1 |
Advisories 1
- DSA-1641-1 phpmyadmin - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2008:202 vendor-advisory
- FEDORA-2008-6868 vendor-advisory
- http://yehg.net/lab/pr0js/advisories/Cross-Site_Framing_inphpMyAdmin2.11.7.pdf
- FEDORA-2008-6810 vendor-advisory
- phpmyadmin-multiple-weak-security(44050) vdb-entry
- 32834 third-party-advisory
- ADV-2008-2226 vdb-entry
- DSA-1641 vendor-advisory
- 31312 third-party-advisory
- 31263 third-party-advisory
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6
- 30420 vdb-entry
- SUSE-SR:2008:026 vendor-advisory