CVE-2011-2508

Name	CVE-2011-2508
Description	Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2286-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
phpmyadmin (PTS)	bullseye	4:5.0.4+dfsg2-2+deb11u1	fixed
	bookworm	4:5.2.1+dfsg-1	fixed
	sid, trixie	4:5.2.1+dfsg-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
phpmyadmin	source	lenny	4:2.11.8.1-5+lenny9	DSA-2286-1
phpmyadmin	source	squeeze	4:3.3.7-6	DSA-2286-1
phpmyadmin	source	(unstable)	4:3.4.3.1-1

[lenny] - phpmyadmin <not-affected> (Vulnerable code not present)