Bugzilla – Bug 964024
VUL-0: phpMyAdmin: Multiple vulnerabilities
Last modified: 2016-02-08 13:12:32 UTC
https://www.phpmyadmin.net/security/PMASA-2016-1/ CVE-2016-2038, Multiple full path disclosure vulnerabilities. https://www.phpmyadmin.net/security/PMASA-2016-2/ CVE-2016-2039, Unsafe generation of XSRF/CSRF token. https://www.phpmyadmin.net/security/PMASA-2016-3/ CVE-2016-2040, Multiple XSS vulnerabilities. https://www.phpmyadmin.net/security/PMASA-2016-4/ CVE-2016-1927, Insecure password generation in JavaScript. https://www.phpmyadmin.net/security/PMASA-2016-5/ CVE-2016-2041, Unsafe comparison of XSRF/CSRF token. https://www.phpmyadmin.net/security/PMASA-2016-6/ CVE-2016-2042, Multiple full path disclosure vulnerabilities. https://www.phpmyadmin.net/security/PMASA-2016-7/ CVE-2016-2043, XSS vulnerability in normalization page. https://www.phpmyadmin.net/security/PMASA-2016-8/ CVE-2016-2044, Full path disclosure vulnerability in SQL parser. https://www.phpmyadmin.net/security/PMASA-2016-9/ CVE-2016-2045, XSS vulnerability in SQL editor.
(In reply to Johannes Segitz from comment #0) > https://www.phpmyadmin.net/security/PMASA-2016-5/ > CVE-2016-2041, Unsafe comparison of XSRF/CSRF token. "We consider this vulnerability to be serious."
(In reply to Andreas Stieger from comment #1) I read that and considered increasing the severity, but it is a timing attack against XSRF/CSRF tokens. I don't think this justifies the increase.
All submitted.
This is an autogenerated message for OBS integration: This bug (964024) was mentioned in https://build.opensuse.org/request/show/356588 42.1+13.2 / phpMyAdmin https://build.opensuse.org/request/show/356589 13.1 / phpMyAdmin
release
openSUSE-SU-2016:0357-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 964024 CVE References: CVE-2016-1927,CVE-2016-2038,CVE-2016-2039,CVE-2016-2040,CVE-2016-2041,CVE-2016-2042,CVE-2016-2043 Sources used: openSUSE Leap 42.1 (src): phpMyAdmin-4.4.15.4-13.1 openSUSE 13.2 (src): phpMyAdmin-4.4.15.4-27.1
openSUSE-SU-2016:0378-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 964024 CVE References: CVE-2016-1927,CVE-2016-2038,CVE-2016-2039,CVE-2016-2040,CVE-2016-2041,CVE-2016-2042,CVE-2016-2043 Sources used: openSUSE 13.1 (src): phpMyAdmin-4.4.15.4-46.1