ArbitraryServerRegexp bypass

PMASA-2016-52 Announcement-ID: PMASA-2016-52 Date: 2016-07-25 Summary ArbitraryServerRegexp bypass Description A vulnerability was reported with the $cfg'ArbitraryServerRegexp' configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by...

Denial of service (DOS) attack with dbase extension

PMASA-2016-55 Announcement-ID: PMASA-2016-55 Date: 2016-07-25 Summary Denial of service DOS attack with dbase extension Description A flaw was discovered where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. Severity We consider this...

Remote code execution vulnerability when run as CGI

PMASA-2016-54 Announcement-ID: PMASA-2016-54 Date: 2016-07-25 Updated: 2016-12-08 Summary Remote code execution vulnerability when run as CGI Description A vulnerability was discovered where a user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI...

Denial of service (DOS) attack by changing password to a very long string

PMASA-2016-53 Announcement-ID: PMASA-2016-53 Date: 2016-07-25 Summary Denial of service DOS attack by changing password to a very long string Description An authenticated user can trigger a denial-of-service DOS attack by entering a very long password at the change password dialog. Severity We...

Remote code execution vulnerability when PHP is running with dbase extension

PMASA-2016-56 Announcement-ID: PMASA-2016-56 Date: 2016-07-25 Summary Remote code execution vulnerability when PHP is running with dbase extension Description A vulnerability was discovered where phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations...

Debian DSA-3627-1 : phpmyadmin - security update

Several vulnerabilities have been fixed in phpMyAdmin, the web-based MySQL administration interface. - CVE-2016-1927 The suggestPassword function relied on a non-secure random number generator which makes it easier for remote attackers to guess generated passwords via a brute-force approach. -...

[SECURITY] [DSA 3627-1] phpmyadmin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3627-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst July 24, 2016 https://www.debian.org/security/faq -...

Bypass URL redirect protection

PMASA-2016-49 Announcement-ID: PMASA-2016-49 Date: 2016-07-24 Summary Bypass URL redirect protection Description A vulnerability was discovered where an attacker could redirect a user to a malicious web page. Severity We consider this to be of moderate severity Affected Versions All 4.6.x version...

Referrer leak in url.php

PMASA-2016-50 Announcement-ID: PMASA-2016-50 Date: 2016-07-24 Summary Referrer leak in url.php Description A vulnerability was discovered where an attacker can determine the phpMyAdmin host location through the file url.php. Severity We consider this to be of moderate severity. Affected Versions...

DSA-3627-1 phpmyadmin - security update

Bulletin has no description...

Detect if user is logged in

PMASA-2016-48 Announcement-ID: PMASA-2016-48 Date: 2016-07-24 Summary Detect if user is logged in Description A vulnerability was reported where an attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerabilit...

Reflected File Download attack

PMASA-2016-51 Announcement-ID: PMASA-2016-51 Date: 2016-07-24 Summary Reflected File Download attack Description A vulnerability was discovered where an attacker may be able to trigger a user to download a specially crafted malicious SVG file. Severity We consider this issue to be of moderate...

IPv6 and proxy server IP-based authentication rule circumvention

PMASA-2016-47 Announcement-ID: PMASA-2016-47 Date: 2016-07-21 Summary IPv6 and proxy server IP-based authentication rule circumvention Description A vulnerability was discovered where, under certain circumstances, it may be possible to circumvent the phpMyAdmin IP-based authentication rules. When...

DOS attack with forced persistent connections

PMASA-2016-45 Announcement-ID: PMASA-2016-45 Date: 2016-07-21 Summary DOS attack with forced persistent connections Description A vulnerability was discovered where an unauthenticated user is able to execute a denial-of-service DOS attack by forcing persistent connections when phpMyAdmin is runni...

phpMyAdmin 4.0.10.x < 4.0.10.16 / 4.4.15.x < 4.4.15.7 / 4.6.x < 4.6.3 Multiple Vulnerabilities

Binary data 9400.prm...

Debian DLA-551-1 : phpmyadmin security update

Phpmyadmin, a web administration tool for MySQL, had several Cross Site Scripting XSS vulnerabilities were reported. CVE-2016-5731 With a specially crafted request, it is possible to trigger an XSS attack through the example OpenID authentication script. CVE-2016-5733 Several XSS vulnerabilities...

[SECURITY] [DLA 551-1] phpmyadmin security update

Package : phpmyadmin Version : 4:3.4.11.1-2+deb7u5 CVE ID : CVE-2016-5731 CVE-2016-5733 CVE-2016-5739 Phpmyadmin, a web administration tool for MySQL, had several Cross Site Scripting XSS vulnerabilities were reported. CVE-2016-5731 With a specially crafted request, it is possible to trigger an X...

DLA-551-1 phpmyadmin - security update

Bulletin has no description...

Fedora 23 : phpMyAdmin (2016-9df3915036)

phpMyAdmin 4.6.3 2016-06-23 ============================= This version includes many security fixes that are announced as PMASA-2016-17 through PMASA-2016-28 which are posted at https://www.phpmyadmin.net/security/ Furthermore, version 4.6.3 includes the regularly scheduled maintenance improvemen...

Fedora 24 : phpMyAdmin (2016-81c2dabf20)

phpMyAdmin 4.6.3 2016-06-23 ============================= This version includes many security fixes that are announced as PMASA-2016-17 through PMASA-2016-28 which are posted at https://www.phpmyadmin.net/security/ Furthermore, version 4.6.3 includes the regularly scheduled maintenance improvemen...