phpMyAdmin contains a flaw related to the 'PMA_Bookmark_get' function in 'libraries/bookmark.lib.php' failing to properly restrict bookmark queries. This makes it easier for a remote authenticated attacker to cause another user to execute bookmarked SQL queries.

Upgrade to version 3.3.9.2 or 2.11.11.3 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2011-0987 (see also: NVD)
• Secunia Advisory ID: 43324 43391 43412 43478 47385
• VUPEN Advisory: ADV-2011-0381
• Vendor Specific News/Changelog Entry: http://lists.debian.org/debian-security-announce/2011/msg00033.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html
  http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=a5464b4daff0059cdf8c9e5f4d54a80e2dd2a5b0
  http://www.gentoo.org/security/en/glsa/glsa-201201-01.xml
  http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php
• Vendor Specific Advisory URL: http://moodle.org/mod/forum/discuss.php?d=169336
• Other Advisory URL: http://www.mandriva.com/security/advisories?name=MDVSA-2011:026

• Not Available