MGASA-2016-0092: phpmyadmin Mageia
CVSS: UnknownPublished
Published 02-03-2016Last modified 16-04-2026
Vulnerability summary
MGASA-2016-0092 is a vulnerability in phpmyadmin Mageia with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 2 · Downstream 0Timeline
- 02-03-2016PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated phpmyadmin packages fix security vulnerabilities Updated phpmyadmin package fixes security vulnerabilities: Multiple cross-site scripting (XSS) issues in phpMyAdmin before 4.4.15.5 (CVE-2016-2560, CVE-2016-2561).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia1 product
- phpmyadmin< 4.4.15.5-1.2.mga5
1 vendor · 1 product
References
6 linksRelated vulnerabilities
MGASA-2017-0100mageiaphpmyadminUpdated phpmyadmin packages fix security vulnerability
A vulnerability was discovered where the restrictions caused by
$cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain
PHP versions. This can allow the login of users who have no password set
even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword']
to false (which is also the default).MGASA-2017-0038mageiaphpmyadminUpdated phpmyadmin packages fix security vulnerabilities
Multiple vulnerabilities in setup script (CVE-2016-6621 / PMASA-2016-44).
Open redirect (PMASA-2017-1).
php-gettext code execution (CVE-2015-8980 / PMASA-2017-2).
DOS vulnerability in table editing (PMASA-2017-3).
CSS injection in themes (PMASA-2017-4).
SSRF in replication (PMASA-2017-6).
DOS in replication status (PMASA-2017-7).MGASA-2016-0416mageiaphpmyadminUpdated phpmyadmin packages fix security vulnerability
In phpMyAdmin before 4.4.15.9, when the user does not specify a
blowfish_secret key for encrypting cookies, phpMyAdmin generates one at
runtime. A vulnerability was reported where the way this value is created
using a weak algorithm. This could allow an attacker to determine the
user's blowfish_secret and potentially decrypt their cookies
(CVE-2016-9847).
In phpMyAdmin before 4.4.15.9, phpinfo.php shows PHP information including
values of sensitive HttpOnly cookies (CVE-2016-9848).
In phpMyAdmin before 4.4.15.9, it is possible to bypass AllowRoot
restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username
by using Null Byte in the username (CVE-2016-9849).
In phpMyAdmin before 4.4.15.9, a vulnerability in username matching for
the allow/deny rules may result in wrong matches and detection of the
username in the rule due to non-constant execution time (CVE-2016-9850).
In phpMyAdmin before 4.4.15.9, with a crafted request parameter value it
is possible to bypass the logout timeout (CVE-2016-9851).
In phpMyAdmin before 4.4.15.9, by calling some scripts that are part of
phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of the directory
where phpMyAdmin is installed. During an execution timeout in the export
functionality, the errors containing the full path of the directory of
phpMyAdmin is written to the export file (CVE-2016-9852, CVE-2016-9853,
CVE-2016-9854, CVE-2016-9855).
In phpMyAdmin before 4.4.15.9, several XSS vulnerabilities have been
reported, including an improper fix for PMASA-2016-10 and a weakness in a
regular expression using in some JavaScript processing (CVE-2016-9856,
CVE-2016-9857).
In phpMyAdmin before 4.4.15.9, with a crafted request parameter value it
is possible to initiate a denial of service attack in saved searches
feature (CVE-2016-9858).
In phpMyAdmin before 4.4.15.9, with a crafted request parameter value it
is possible to initiate a denial of service attack in import feature
(CVE-2016-9859).
In phpMyAdmin before 4.4.15.9, an unauthenticated user can execute a
denial of service attack when phpMyAdmin is running with
$cfg['AllowArbitraryServer']=true; (CVE-2016-9860).
In phpMyAdmin before 4.4.15.9, due to the limitation in URL matching, it
was possible to bypass the URL white-list protection (CVE-2016-9861).
In phpMyAdmin before 4.4.15.9, with a crafted username or a table name,
it was possible to inject SQL statements in the tracking functionality
that would run with the privileges of the control user. This gives read
and write access to the tables of the configuration storage database, and
if the control user has the necessary privileges, read access to some
tables of the mysql database (CVE-2016-9864).
In phpMyAdmin before 4.4.15.9, due to a bug in serialized string parsing,
it was possible to bypass the protection offered by PMA_safeUnserialize()
function (CVE-2016-9865).
In phpMyAdmin before 4.4.15.9, when the arg_separator is different from
its default value of &, the token was not properly stripped from the
return URL of the preference import action (CVE-2016-9866).MGASA-2016-0291mageiaphpmyadminUpdated phpmyadmin packages fix security vulnerability
In phpMyAdmin before 4.4.15.8, the decryption of the username/password is
vulnerable to a padding oracle attack. The can allow an attacker who has
access to a user's browser cookie file to decrypt the username and
password. Also, the same initialization vector (IV) is used to hash the
username and password stored in the phpMyAdmin cookie. If a user has the
same password as their username, an attacker who examines the browser
cookie can see that they are the same (CVE-2016-6606).
In phpMyAdmin before 4.4.15.8, multiple vulnerabilities have been
discovered in the following areas of phpMyAdmin: Zoom search, GIS editor,
Relation view, several Transformations, XML export, MediaWiki export,
Designer, when the MySQL server is running with a specially-crafted
log_bin directive, Database tab, Replication feature, and Database search
(CVE-2016-6607).
In phpMyAdmin before 4.4.15.8, a vulnerability was found where a specially
crafted database name could be used to run arbitrary PHP commands through
the array export feature (CVE-2016-6609).
In phpMyAdmin before 4.4.15.8, a full path disclosure vulnerability was
discovered where a user can trigger a particular error in the export
mechanism to discover the full path of phpMyAdmin on the disk
(CVE-2016-6610).
In phpMyAdmin before 4.4.15.8, a vulnerability was reported where a
specially crafted database and/or table name can be used to trigger an SQL
injection attack through the export functionality (CVE-2016-6611).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered where a user
can exploit the LOAD LOCAL INFILE functionality to expose files on the
server to the database system (CVE-2016-6612).
In phpMyAdmin before 4.4.15.8, a vulnerability was found where a user can
specially craft a symlink on disk, to a file which phpMyAdmin is permitted
to read but the user is not, which phpMyAdmin will then expose to the user
(CVE-2016-6613).
In phpMyAdmin before 4.4.15.8, a vulnerability was reported with the %u
username replacement functionality of the SaveDir and UploadDir features.
When the username substitution is configured, a specially-crafted user
name can be used to circumvent restrictions to traverse the file system
(CVE-2016-6614).
In phpMyAdmin before 4.4.15.8, multiple XSS vulnerabilities were found in
the following areas: Navigation pane and database/table hiding feature,
the "Tracking" feature, and GIS visualization feature (CVE-2016-6615).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered in the
following features where a user can execute an SQL injection attack
against the account of the control user: User group Designer
(CVE-2016-6616).
In phpMyAdmin before 4.4.15.8, a vulnerability was found in the
transformation feature allowing a user to trigger a denial-of-service
(DOS) attack against the server (CVE-2016-6618).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered in the user
interface preference feature where a user can execute an SQL injection
attack against the account of the control user (CVE-2016-6619).
In phpMyAdmin before 4.4.15.8, a vulnerability was reported where some
data is passed to the PHP unserialize() function without verification that
it's valid serialized data. A malicious user may be able to manipulate the
stored data in a way to result in code being loaded and executed
(CVE-2016-6620).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered where an
unauthenticated user is able to execute a denial-of-service (DOS) attack
by forcing persistent connections when phpMyAdmin is running with
$cfg['AllowArbitraryServer']=true; (CVE-2016-6622).
In phpMyAdmin before 4.4.15.8, a vulnerability has been reported where a
malicious authorized user can cause a denial-of-service (DOS) attack on a
server by passing large values to a loop (CVE-2016-6623).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered where, under
certain circumstances, it may be possible to circumvent the phpMyAdmin
IP-based authentication rules. When phpMyAdmin is used with IPv6 in a
proxy server environment, and the proxy server is in the allowed range but
the attacking computer is not allowed, this vulnerability can allow the
attacking computer to connect despite the IP rules (CVE-2016-6624).
In phpMyAdmin before 4.4.15.8, a vulnerability was reported where an
attacker can determine whether a user is logged in to phpMyAdmin
(CVE-2016-6625).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered where an
attacker could redirect a user to a malicious web page (CVE-2016-6626).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered where an
attacker can determine the phpMyAdmin host location through the file
url.php (CVE-2016-6627).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered where an
attacker may be able to trigger a user to download a specially crafted
malicious SVG file (CVE-2016-6628).
In phpMyAdmin before 4.4.15.8, a vulnerability was reported with the
$cfg['ArbitraryServerRegexp'] configuration directive. An attacker could
reuse certain cookie values in a way of bypassing the servers defined by
ArbitraryServerRegexp (CVE-2016-6629).
In phpMyAdmin before 4.4.15.8, an authenticated user can trigger a
denial-of-service (DOS) attack by entering a very long password at the
change password dialog (CVE-2016-6630).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered where a user
can execute a remote code execution attack against a server when
phpMyAdmin is being run as a CGI application. Under certain server
configurations, a user can pass a query string which is executed as a
command-line argument by the file generator_plugin.sh (CVE-2016-6631).
In phpMyAdmin before 4.4.15.8, a flaw was discovered where, under certain
conditions, phpMyAdmin may not delete temporary files during the import
of ESRI files (CVE-2016-6632).
In phpMyAdmin before 4.4.15.8, a vulnerability was discovered where
phpMyAdmin can be used to trigger a remote code execution attack against
certain PHP installations (CVE-2016-6633).MGASA-2016-0240mageiaphpmyadminUpdated phpmyadmin packages fix security vulnerability
In phpMyAdmin before 4.4.15.7, a vulnerability was discovered that allows
a BBCode injection to setup script in case it's not accessed on https
(CVE-2016-5701).
In phpMyAdmin before 4.4.15.7, a vulnerability was discovered that allows
an SQL injection attack to run arbitrary commands as the control user
(CVE-2016-5703).
In phpMyAdmin before 4.4.15.7, XSS vulnerabilities were discovered in the
user privileges page, the error console, and the central columns, query
bookmarks, and user groups features (CVE-2016-5705).
In phpMyAdmin before 4.4.15.7, a Denial Of Service (DOS) attack was
discovered in the way phpMyAdmin loads some JavaScript files
(CVE-2016-5706).
In phpMyAdmin before 4.4.15.7, by specially crafting requests in the
following areas, it is possible to trigger phpMyAdmin to display a PHP
error message which contains the full path of the directory where
phpMyAdmin is installed (CVE-2016-5730).
In phpMyAdmin before 4.4.15.7, with a specially crafted request, it is
possible to trigger an XSS attack through the example OpenID
authentication script (CVE-2016-5731).
In phpMyAdmin before 4.4.15.7, XSS vulnerabilities were found through
specially crafted databases, in AJAX error handling, and in the
Transformation, Designer, charts, and zoom search features
(CVE-2016-5733).
In phpMyAdmin before 4.4.15.7, a vulnerability was reported where a
specially crafted Transformation could be used to leak information
including the authentication token. This could be used to direct a CSRF
attack against a user (CVE-2016-5739).MGASA-2016-0051mageiaphpmyadmin+1Updated phpmyadmin/phpseclib packages fix security vulnerability
Password suggestion functionality uses Math.random() which does not
provide cryptographically secure random numbers (CVE-2016-1927).
By calling some scripts that are part of phpMyAdmin in an unexpected way,
it is possible to trigger phpMyAdmin to display a PHP error message which
contains the full path of the directory where phpMyAdmin is installed
(CVE-2016-2038).
The XSRF/CSRF token is generated with a weak algorithm using functions
that do not return cryptographically secure values (CVE-2016-2039).
With a crafted table name it is possible to trigger an XSS attack in the
database search page. With a crafted SET value or a crafted search query,
it is possible to trigger an XSS attacks in the zoom search page. With a
crafted hostname header, it is possible to trigger an XSS attacks in the
home page (CVE-2016-2040).
The comparison of the XSRF/CSRF token parameter with the value saved in
the session is vulnerable to timing attacks. Moreover, the comparison
could be bypassed if the XSRF/CSRF token matches a particular pattern
(CVE-2016-2041).
The phpmyadmin package has been updated to version 4.4.15.4 in the 4.4.x
stable branch, and the phpseclib dependency has been updated to version
2.0.1.