Lucene search

K
suseSuseOPENSUSE-SU-2020:0405-1
HistoryMar 29, 2020 - 12:00 a.m.

Security update for phpMyAdmin (moderate)

2020-03-2900:00:00
lists.opensuse.org
82
phpmyadmin
sql injection
xss
security update

EPSS

0.002

Percentile

61.2%

An update that fixes three vulnerabilities is now available.

Description:

This update for phpMyAdmin to version 4.9.5 fixes the following issues:

  • phpmyadmin was updated to 4.9.5:

  • CVE-2020-10804: Fixed an SQL injection in the user accounts page,
    particularly when changing a password (boo#1167335 PMASA-2020-2).

  • CVE-2020-10802: Fixed an SQL injection in the search feature
    (boo#1167336 PMASA-2020-3).

  • CVE-2020-10803: Fixed an SQL injection and XSS when displaying results
    (boo#1167337 PMASA-2020-4).

  • Removed the “options” field for the external transformation.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

  • openSUSE Leap 15.1:

    zypper in -t patch openSUSE-2020-405=1

  • SUSE Package Hub for SUSE Linux Enterprise 12:

    zypper in -t patch openSUSE-2020-405=1

OSVersionArchitecturePackageVersionFilename
openSUSE Leap15.1noarch< - openSUSE Leap 15.1 (noarch):- openSUSE Leap 15.1 (noarch):.noarch.rpm
SUSE Package Hub for SUSE Linux Enterprise12noarch< - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch):- SUSE Package Hub for SUSE Linux Enterprise 12 (noarch):.noarch.rpm