Vulnerability: libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Vulnerability ID: CVE-2015-2206
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2015-03-09
File: libraries/select_lang.lib.php
Commit message: [security] Risk of BREACH attack

Thanks to Michal Čihař for the message suggestion.

Signed-off-by: Marc Delisle <marc@infomarc.info>
Commit author: Marc Delisle

Vulnerable version (before fix):
 function PMA_langList()   // now, that we have loaded the language strings we can send the errors if ($GLOBALS['lang_failed_cfg']) {     trigger_error(         sprintf(             __('Unknown language: %1$s.'),             htmlspecialchars($GLOBALS['lang_failed_cfg'])         ),         E_USER_ERROR     ); } if ($GLOBALS['lang_failed_cookie']) {     trigger_error(         sprintf(             __('Unknown language: %1$s.'),             htmlspecialchars($GLOBALS['lang_failed_cookie'])         ),         E_USER_ERROR     ); } if ($GLOBALS['lang_failed_request']) {     trigger_error(         sprintf(             __('Unknown language: %1$s.'),             htmlspecialchars($GLOBALS['lang_failed_request'])         ),         E_USER_ERROR     ); }  unset(     $line, $fall_back_lang, $GLOBALS['lang_failed_cfg'],     $GLOBALS['lang_failed_cookie'], $GLOBALS['lang_failed_request']

Fixed version (after fix):
 function PMA_langList()   // now, that we have loaded the language strings we can send the errors if ($GLOBALS['lang_failed_cfg']     || $GLOBALS['lang_failed_cookie']     || $GLOBALS['lang_failed_request']) {     trigger_error(         __('Ignoring unsupported language code.'),         E_USER_ERROR     ); } unset(     $line, $fall_back_lang, $GLOBALS['lang_failed_cfg'],     $GLOBALS['lang_failed_cookie'], $GLOBALS['lang_failed_request']

Patch:
patch: @@ -600,34 +600,14 @@ function PMA_langList()
 
 
 // now, that we have loaded the language strings we can send the errors
-if ($GLOBALS['lang_failed_cfg']) {
+if ($GLOBALS['lang_failed_cfg']
+    || $GLOBALS['lang_failed_cookie']
+    || $GLOBALS['lang_failed_request']) {
     trigger_error(
-        sprintf(
-            __('Unknown language: %1$s.'),
-            htmlspecialchars($GLOBALS['lang_failed_cfg'])
-        ),
+        __('Ignoring unsupported language code.'),
         E_USER_ERROR
     );
 }
-if ($GLOBALS['lang_failed_cookie']) {
-    trigger_error(
-        sprintf(
-            __('Unknown language: %1$s.'),
-            htmlspecialchars($GLOBALS['lang_failed_cookie'])
-        ),
-        E_USER_ERROR
-    );
-}
-if ($GLOBALS['lang_failed_request']) {
-    trigger_error(
-        sprintf(
-            __('Unknown language: %1$s.'),
-            htmlspecialchars($GLOBALS['lang_failed_request'])
-        ),
-        E_USER_ERROR
-    );
-}
-
 unset(
     $line, $fall_back_lang, $GLOBALS['lang_failed_cfg'],
     $GLOBALS['lang_failed_cookie'], $GLOBALS['lang_failed_request']
path: libraries/select_lang.lib.php