http://bugzilla.suse.com/show_bug.cgi?id=994313 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |astieger@suse.com, | |meissner@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c2 --- Comment #2 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-55/ PMASA-2016-55 Announcement-ID: PMASA-2016-55 Date: 2016-07-25 Summary Denial of service (DOS) attack with dbase extension Description A flaw was discovered where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. Severity We consider this vulnerability to be non-critical. Mitigation factor This vulnerability only exists when PHP is running with the dbase extension, which is not shipped by default, not available in most Linux distributions, and doesn't compile with PHP7. Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, 4.0.10.17, or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6632 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: 6f8eb09 The following commits have been made on the 4.4 branch to fix this issue: e31ac0b The following commits have been made on the 4.6 branch to fix this issue: 48764f2 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c4 --- Comment #4 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-53/ Announcement-ID: PMASA-2016-53 Date: 2016-07-25 Summary Denial of service (DOS) attack by changing password to a very long string Description An authenticated user can trigger a denial-of-service (DOS) attack by entering a very long password at the change password dialog. Severity We consider this vulnerability to be serious. Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, 4.0.10.17, or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6630 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: b0e6671 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c6 --- Comment #6 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-51/ PMASA-2016-51 Announcement-ID: PMASA-2016-51 Date: 2016-07-24 Summary Reflected File Download attack Description A vulnerability was discovered where an attacker may be able to trigger a user to download a specially crafted malicious SVG file. Severity We consider this issue to be of moderate severity. Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer, or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6628 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: f261abb The following commits have been made on the 4.4 branch to fix this issue: a553a11 The following commits have been made on the 4.6 branch to fix this issue: 623f5b4 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c8 --- Comment #8 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-49/ PMASA-2016-49 Announcement-ID: PMASA-2016-49 Date: 2016-07-24 Summary Bypass URL redirect protection Description A vulnerability was discovered where an attacker could redirect a user to a malicious web page. Severity We consider this to be of moderate severity Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer, or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6626 CWE ids: CWE-661 Patches The following commits have been made on the 4.6 branch to fix this issue: 67d6eea The following commits have been made on the 4.4 branch to fix this issue: 88c72dc The following commits have been made on the 4.0 branch to fix this issue: e8c5cab -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c10 --- Comment #10 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-47/ PMASA-2016-47 Announcement-ID: PMASA-2016-47 Date: 2016-07-21 Summary IPv6 and proxy server IP-based authentication rule circumvention Description A vulnerability was discovered where, under certain circumstances, it may be possible to circumvent the phpMyAdmin IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. Severity We consider this vulnerability to be serious Mitigation factor * The phpMyAdmin installation must be running with IP-based allow/deny rules * The phpMyAdmin installation must be running behind a proxy server (or proxy servers) where the proxy server is "allowed" and the attacker is "denied" * The connection between the proxy server and phpMyAdmin must be via IPv6 Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6624 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: 4440790 The following commits have been made on the 4.4 branch to fix this issue: e291300 The following commits have been made on the 4.6 branch to fix this issue: 6aacd7d -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c12 --- Comment #12 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-45/ PMASA-2016-45 Announcement-ID: PMASA-2016-45 Date: 2016-07-21 Summary DOS attack with forced persistent connections Description A vulnerability was discovered where an unauthenticated user is able to execute a denial-of-service (DOS) attack by forcing persistent connections when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true;. Severity We consider this vulnerability to be critical, although note that phpMyAdmin is not vulnerable by default. Mitigation factor This attack requires phpMyAdmin to be configured with`$cfg['AllowArbitraryServer']=true;` Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6622 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: 8e0918c The following commits have been made on the 4.4 branch to fix this issue: 10bdb0d The following commits have been made on the 4.6 branch to fix this issue: 767195e -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c14 --- Comment #14 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-43/ PMASA-2016-43 Announcement-ID: PMASA-2016-43 Date: 2016-07-15 Summary Unvalidated data passed to unserialize() Description A vulnerability was reported where some data is passed to the PHP unserialize() function without verification that it's valid serialized data. Due to how the PHP function operates, Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Therefore, a malicious user may be able to manipulate the stored data in a way to exploit this weakness. Severity We consider this vulnerability to be moderately severe. Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6620 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: 80c9302 The following commits have been made on the 4.4 branch to fix this issue: 2104fb6 The following commits have been made on the 4.6 branch to fix this issue: ba072e4 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c16 --- Comment #16 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-41/ PMASA-2016-41 Announcement-ID: PMASA-2016-41 Date: 2016-07-14 Summary Denial of service (DOS) attack in transformation feature Description A vulnerability was found in the transformation feature allowing a user to trigger a denial-of-service (DOS) attack against the server. Severity We consider this vulnerability to be non-critical Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, 4.0.10.17, or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6618 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: ff88cdb The following commits have been made on the 4.4 branch to fix this issue: 2582fa1 The following commits have been made on the 4.6 branch to fix this issue: 551031d -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c18 --- Comment #18 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-39/ PMASA-2016-39 Announcement-ID: PMASA-2016-39 Date: 2016-07-14 Summary SQL injection attack Description A vulnerability was discovered in the following features where a user can execute an SQL injection attack against the account of the control user: User group Designer Severity We consider this vulnerability to be serious. Mitigation factor The server must have a control user account created in MySQL and configured in phpMyAdmin; installations without a control user are not vulnerable. Affected Versions All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting these vulnerabilities. Assigned CVE ids: CVE-2016-6616 CWE ids: CWE-661 Patches The following commits have been made on the 4.4 branch to fix this issue: 93a6913 5d427d6 5d427d6 The following commits have been made on the 4.6 branch to fix this issue: 9f11a0e 80b03a4 80b03a4 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c20 --- Comment #20 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-37/ PMASA-2016-37 Announcement-ID: PMASA-2016-37 Date: 2016-07-12 Summary Path traversal with SaveDir and UploadDir Description A vulnerability was reported with the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. Severity We consider this vulnerability to be serious, however due to the mitigation factors the default state is not vulnerable. Mitigation factor 1) A system must be configured with the %u username replacement, such as `$cfg['SaveDir'] = 'SaveDir_%u';` 2) The user must be able to create a specially-crafted MySQL user, including the `/.` sequence of characters, such as `/../../` Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6614 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: c6cfb58 The following commits have been made on the 4.4 branch to fix this issue: 2989e49 The following commits have been made on the 4.6 branch to fix this issue: 5491d67 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c22 --- Comment #22 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-35/ PMASA-2016-35 Announcement-ID: PMASA-2016-35 Date: 2016-07-12 Summary Local file exposure Description A vulnerability was discovered where a user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. Severity We consider this vulnerability to be serious. Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, 4.0.10.17, or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6612 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: d03954b The following commits have been made on the 4.4 branch to fix this issue: d02d61a The following commits have been made on the 4.6 branch to fix this issue: 1e6b740 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c24 --- Comment #24 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-33/ PMASA-2016-33 Announcement-ID: PMASA-2016-33 Date: 2016-07-12 Summary Full path disclosure Description A full path disclosure vulnerability was discovered where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. Severity We consider this vulnerability to be non-critical. Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, 4.0.10.17, or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6610 CWE ids: CWE-661 Patches The following commits have been made on the 4.0 branch to fix this issue: 7f7a8ac The following commits have been made on the 4.4 branch to fix this issue: 5b7da18 The following commits have been made on the 4.6 branch to fix this issue: dd73213 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c26 --- Comment #26 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-31/ PMASA-2016-31 Announcement-ID: PMASA-2016-31 Date: 2016-07-11 Summary Multiple XSS vulnerabilities Description XSS vulnerabilities were discovered in: The database privilege check The "Remove partitioning" functionality Specially crafted database names can trigger the XSS attack. Severity We consider these vulnerabilities to be of moderate severity. Affected Versions All 4.6.x versions (prior to 4.6.4) are affected Solution Upgrade to phpMyAdmin 4.6.4 or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6608 CWE ids: CWE-661 Patches The following commits have been made on the 4.6 branch to fix this issue: f0f8f2b 0fad729 a32b3ce 7e510e8 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c28 --- Comment #28 from Marcus Meissner --- https://www.phpmyadmin.net/security/PMASA-2016-29/ PMASA-2016-29 Announcement-ID: PMASA-2016-29 Date: 2016-07-07 Summary Weakness with cookie encryption Description A pair of vulnerabilities were found affecting the way cookies are stored. The decryption of the username/password is vulnerable to a padding oracle attack. The can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. A vulnerability was found where the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same — but the attacker can not directly decode these values from the cookie as it is still hashed. Severity We consider this to be critical. Affected Versions All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected Solution Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, 4.0.10.17, or newer or apply patch listed below. References Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability. Assigned CVE ids: CVE-2016-6606 CWE ids: CWE-661 Patches The following commits have been made on the 4.6 branch to fix this issue: a97be3a The following commits have been made on the 4.4 branch to fix this issue: cd682a6 The following commits have been made on the 4.0 branch to fix this issue: 95b7b7d -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c33 --- Comment #33 from Marcus Meissner --- from ubuntu changes: - SSRF in setup script (PMASA-2016-44, CVE-2016-6621) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c34 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #34 from Marcus Meissner --- released -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c36 --- Comment #36 from Swamp Workflow Management --- openSUSE-SU-2016:2176-1: An update that fixes 28 vulnerabilities is now available. Category: security (moderate) Bug References: 994313 CVE References: CVE-2016-6606,CVE-2016-6607,CVE-2016-6608,CVE-2016-6609,CVE-2016-6610,CVE-2016-6611,CVE-2016-6612,CVE-2016-6613,CVE-2016-6614,CVE-2016-6615,CVE-2016-6616,CVE-2016-6617,CVE-2016-6618,CVE-2016-6619,CVE-2016-6620,CVE-2016-6621,CVE-2016-6622,CVE-2016-6623,CVE-2016-6624,CVE-2016-6625,CVE-2016-6626,CVE-2016-6627,CVE-2016-6628,CVE-2016-6629,CVE-2016-6630,CVE-2016-6631,CVE-2016-6632,CVE-2016-6633 Sources used: openSUSE 13.1 (src): phpMyAdmin-4.4.15.8-63.1 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=994313 http://bugzilla.suse.com/show_bug.cgi?id=994313#c38 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |security-team@suse.de --- Comment #38 from Marcus Meissner --- CVE-2016-6606 CVE-2016-6607 CVE-2016-6608 CVE-2016-6609 CVE-2016-6610 CVE-2016-6611 CVE-2016-6612 CVE-2016-6613 CVE-2016-6614 CVE-2016-6615 CVE-2016-6616 CVE-2016-6617 CVE-2016-6618 CVE-2016-6619 CVE-2016-6620 CVE-2016-6621 CVE-2016-6622 CVE-2016-6623 CVE-2016-6624 CVE-2016-6625 CVE-2016-6626 CVE-2016-6627 CVE-2016-6628 CVE-2016-6629 CVE-2016-6630 CVE-2016-6631 CVE-2016-6632 CVE-2016-6633 fixed by it -- You are receiving this mail because: You are on the CC list for the bug.