[SECURITY] [DLA 757-1] phpmyadmin security update

Package : phpmyadmin
Version : 4:3.4.11.1-2+deb7u7
CVE ID : CVE-2016-4412 CVE-2016-6626 CVE-2016-9849 CVE-2016-9850
CVE-2016-9861 CVE-2016-9864 CVE-2016-9865

Various security issues where found and fixed in phpmyadmin in wheezy.

CVE-2016-4412 / PMASA-2016-57

A user can be tricked in following a link leading to phpMyAdmin, which
after authentication redirects to another malicious site.

CVE-2016-6626 / PMASA-2016-49

In the fix for PMASA-2016-57, we didn't have sufficient checking and was
possible to bypass whitelist.

CVE-2016-9849 / PMASA-2016-60

Username deny rules bypass (AllowRoot & Others) by using Null Byte.

CVE-2016-9850 / PMASA-2016-61

Username matching for the allow/deny rules
may result in wrong matches and detection of the username in the rule due
to non-constant execution time.

CVE-2016-9861 / PMASA-2016-66

In the fix for PMASA-2016-49, we has buggy checks and was possible to
bypass whitelist.

CVE-2016-9864 / PMASA-2016-69

Multiple SQL injection vulnerabilities.

CVE-2016-9865 / PMASA-2016-70

Due to a bug in serialized string parsing, it was possible to bypass the
protection offered by PMA_safeUnserialize() function.

For Debian 7 "Wheezy", these problems have been fixed in version
4:3.4.11.1-2+deb7u7.

We recommend that you upgrade your phpmyadmin packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS