{"cves":[{"id":"CVE-2016-6626","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. An attacker could redirect a user to\na malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions\n(prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-49/","https://www.cve.org/CVERecord?id=CVE-2016-6626"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/88c72dc"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6625","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. An attacker can determine whether a\nuser is logged in to phpMyAdmin. The user's session, username, and password\nare not compromised by this vulnerability. All 4.6.x versions (prior to\n4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to\n4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":4.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-48/","https://www.cve.org/CVERecord?id=CVE-2016-6625"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/61591c4"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6624","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin involving improper enforcement of the\nIP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy\nserver environment, and the proxy server is in the allowed range but the\nattacking computer is not allowed, this vulnerability can allow the\nattacking computer to connect despite the IP rules. All 4.6.x versions\n(prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions\n(prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.9,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-47/","https://www.cve.org/CVERecord?id=CVE-2016-6624"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/e291300"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6623","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. An authorized user can cause a\ndenial-of-service (DoS) attack on a server by passing large values to a\nloop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to\n4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-46/","https://www.cve.org/CVERecord?id=CVE-2016-6623"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/62ae47c"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6622","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. An unauthenticated user is able to\nexecute a denial-of-service (DoS) attack by forcing persistent connections\nwhen phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All\n4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and\n4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"negligible","cvss3":5.9,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-45/","https://www.cve.org/CVERecord?id=CVE-2016-6622"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/10bdb0d"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6620","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. Some data is passed to the PHP\nunserialize() function without verification that it's valid serialized\ndata. The unserialization can result in code execution because of the\ninteraction with object instantiation and autoloading. All 4.6.x versions\n(prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions\n(prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-43/","https://www.cve.org/CVERecord?id=CVE-2016-6620"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/2104fb6"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6619","published":"2016-12-11T02:59:00","updated_at":"2025-08-25T22:08:22.811772+00:00","description":"\nAn issue was discovered in phpMyAdmin. In the user interface preference\nfeature, a user can execute an SQL injection attack against the account of\nthe control user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions\n(prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-42/","https://www.cve.org/CVERecord?id=CVE-2016-6619","https://ubuntu.com/security/notices/USN-4843-1"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/b49dba4"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"4:4.0.10-1ubuntu0.1+esm3","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"4:4.5.4.1-2ubuntu2.1+esm5","component":null,"pocket":"esm-apps"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":["USN-4843-1"],"notices":[{"id":"USN-4843-1","title":"phpMyAdmin vulnerabilities","summary":"Several security issues were fixed in phpMyAdmin.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-03-16T14:27:57.040177","description":"Javier Nieto and Andres Rojas discovered that phpMyAdmin incorrectly\nmanaged input in the form of passwords. An attacker could use this\nvulnerability to cause a denial-of-service (DoS). This issue only\naffected Ubuntu 14.04 ESM. (CVE-2014-9218)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of database names in the PHP Array export feature.\nAn authenticated attacker could use this vulnerability to run arbitrary\nPHP commands. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6609)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6619)\n\nEmanuel Bronshtein discovered that phpMyadmin failed to properly sanitize\ninput. An authenticated attacker could use this vulnerability to cause a\ndenial-of-service (DoS). This issue only affected Ubuntu 14.04 ESM and\nUbuntu 16.04 ESM. (CVE-2016-6630)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to bypass AllowRoot\nrestrictions and deny rules for usernames. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9849)\n\nEmanuel Bronshtein discovered that phpMyAdmin would allow sensitive\ninformation to be leaked when the argument separator in a URL was\nnot the default & value. An attacker could use this vulnerability to\nobtain the CSRF token of a user. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9866)\n\nIsaac Bennetch discovered that phpMyAdmin was incorrectly restricting\nuser access due to the behavior of the substr function on some PHP\nversions. An attacker could use this vulnerability to bypass login\nrestrictions established for users that have no password set. This\nissue only affected Ubuntu 14.04 ESM. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-18264)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of parameters sent during a table editing operation. An\nattacker could use this vulnerability to trigger an endless recursion\nand cause a denial-of-service (DoS). This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2017-1000014)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput used to generate a web page. An authenticated attacker could use this\nvulnerability to execute CSS injection attacks. This issue only affected\nUbuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-1000015)\n\nIt was discovered that phpMyAdmin incorrectly handled certain input. An\nattacker could use this vulnerability to execute a cross-site scripting (XSS)\nattack via a crafted URL. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2018-7260)\n\nIt was discovered phpMyAdmin incorrectly handled database names. An\nattacker could possibly use this to trigger a cross-site scripting\nattack. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2018-12581)\n\nDaniel Le Gall discovered that phpMyAdmin would expose sensitive\ninformation to unauthorized actors due to an error in its transformation\nfeature. An authenticated attacker could use this vulnerability to leak\nthe contents of a local file. This issue only affected Ubuntu 14.04 ESM\nand Ubuntu 16.04 ESM. (CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this to perform a cross-site scripting attack.\nThis issue only affected Ubuntu 16.04 ESM. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. This issue only affected Ubuntu\n16.04 ESM. (CVE-2019-11768)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 16.04 ESM. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 14.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2019-12922)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2019-6798)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2019-19617)\n\nCSW Research Labs discovered that phpMyAdmin failed to properly sanitize\ninput.  An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 16.04 ESM. (CVE-2020-5504)\n\nGiwan Go and Yelang Lee discovered that phpMyAdmin was vulnerable to an\nXSS attack in the transformation feature. If a victim were to click on a\ncrafted link, an attacker could run malicious JavaScript on the victim's\nsystem. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2020-26934)\n\nAndre Sá discovered that phpMyAdmin incorrectly handled certain SQL\nstatements in the search feature. A remote, authenticated attacker could\nuse this to inject malicious SQL into a query. This issue only affected\nUbuntu 20.04 ESM. (CVE-2020-26935)\n","is_hidden":false,"release_packages":{"trusty":[{"name":"phpmyadmin","version":"4:4.0.10-1ubuntu0.1+esm4","description":"MySQL web administration tool","is_source":true},{"name":"phpmyadmin","version":"4:4.0.10-1ubuntu0.1+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/phpmyadmin","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"phpmyadmin","version":"4:4.5.4.1-2ubuntu2.1+esm6","description":"MySQL web administration tool","is_source":true},{"name":"phpmyadmin","version":"4:4.5.4.1-2ubuntu2.1+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/phpmyadmin","version_link":null,"pocket":"esm-apps"}],"bionic":[{"name":"phpmyadmin","version":"4:4.6.6-5ubuntu0.5+esm1","description":"MySQL web administration tool","is_source":true},{"name":"phpmyadmin","version":"4:4.6.6-5ubuntu0.5+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/phpmyadmin","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"phpmyadmin","version":"4:4.9.5+dfsg1-2ubuntu0.1~esm1","description":"MySQL web administration tool","is_source":true},{"name":"phpmyadmin","version":"4:4.9.5+dfsg1-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/phpmyadmin","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2019-12922","CVE-2016-6619","CVE-2020-26934","CVE-2019-19617","CVE-2016-9866","CVE-2018-19968","CVE-2018-7260","CVE-2019-11768","CVE-2018-19970","CVE-2019-6798","CVE-2017-1000014","CVE-2017-1000015","CVE-2020-5504","CVE-2018-12581","CVE-2016-6630","CVE-2016-9849","CVE-2020-26935","CVE-2019-12616","CVE-2016-6609","CVE-2014-9218","CVE-2017-18264"]}]},{"id":"CVE-2016-6618","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. The transformation feature allows a\nuser to trigger a denial-of-service (DoS) attack against the server. All\n4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and\n4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"negligible","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-41/","https://www.cve.org/CVERecord?id=CVE-2016-6618"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/2582fa1"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6617","published":"2016-12-11T02:59:00","updated_at":"2025-08-25T22:08:22.811772+00:00","description":"\nAn issue was discovered in phpMyAdmin. A specially crafted database and/or\ntable name can be used to trigger an SQL injection attack through the\nexport functionality. All 4.6.x versions (prior to 4.6.4) are affected.","ubuntu_description":"","notes":[{"author":"ratliff","note":"upstream says 4.6 only"}],"codename":null,"priority":"medium","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-40/","https://www.cve.org/CVERecord?id=CVE-2016-6617"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/ceeef53"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6616","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. In the \"User group\" and \"Designer\"\nfeatures, a user can execute an SQL injection attack against the account of\nthe control user. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions\n(prior to 4.4.15.8) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-39/","https://www.cve.org/CVERecord?id=CVE-2016-6616"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/93a6913","upstream: https://github.com/phpmyadmin/phpmyadmin/commit/5d427d6","upstream: https://github.com/phpmyadmin/phpmyadmin/commit/5d427d6"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6615","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nXSS issues were discovered in phpMyAdmin. This affects navigation pane and\ndatabase/table hiding feature (a specially-crafted database name can be\nused to trigger an XSS attack); the \"Tracking\" feature (a specially-crafted\nquery can be used to trigger an XSS attack); and GIS visualization feature.\nAll 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8)\nare affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"negligible","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-38/","https://www.cve.org/CVERecord?id=CVE-2016-6615"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/20db714","upstream: https://github.com/phpmyadmin/phpmyadmin/commit/6e8a1c0","upstream: https://github.com/phpmyadmin/phpmyadmin/commit/d0b6abf"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6614","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin involving the %u username replacement\nfunctionality of the SaveDir and UploadDir features. When the username\nsubstitution is configured, a specially-crafted user name can be used to\ncircumvent restrictions to traverse the file system. All 4.6.x versions\n(prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions\n(prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[{"author":"ratliff","note":"Upstream notes mitigating factors"}],"codename":null,"priority":"low","cvss3":6.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-37/","https://www.cve.org/CVERecord?id=CVE-2016-6614"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/2989e49"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6613","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. A user can specially craft a symlink\non disk, to a file which phpMyAdmin is permitted to read but the user is\nnot, which phpMyAdmin will then expose to the user. All 4.6.x versions\n(prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions\n(prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"negligible","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-36/","https://www.cve.org/CVERecord?id=CVE-2016-6613"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/c976baa"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6612","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL\nINFILE functionality to expose files on the server to the database system.\nAll 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8),\nand 4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-35/","https://www.cve.org/CVERecord?id=CVE-2016-6612"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/d02d61a"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6611","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nAn issue was discovered in phpMyAdmin. A specially crafted database and/or\ntable name can be used to trigger an SQL injection attack through the\nexport functionality. All 4.6.x versions (prior to 4.6.4), 4.4.x versions\n(prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-34/","https://www.cve.org/CVERecord?id=CVE-2016-6611"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/4f8a16c"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6610","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nA full path disclosure vulnerability was discovered in phpMyAdmin where a\nuser can trigger a particular error in the export mechanism to discover the\nfull path of phpMyAdmin on the disk. All 4.6.x versions (prior to 4.6.4),\n4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17)\nare affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"negligible","cvss3":4.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-33/","https://www.cve.org/CVERecord?id=CVE-2016-6610"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/5b7da18"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6609","published":"2016-12-11T02:59:00","updated_at":"2025-08-25T22:08:22.811772+00:00","description":"\nAn issue was discovered in phpMyAdmin. A specially crafted database name\ncould be used to run arbitrary PHP commands through the array export\nfeature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to\n4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-32/","https://www.cve.org/CVERecord?id=CVE-2016-6609","https://ubuntu.com/security/notices/USN-4843-1"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/6b310f0"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"4:4.0.10-1ubuntu0.1+esm3","component":null,"pocket":"esm-infra"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"4:4.5.4.1-2ubuntu2.1+esm5","component":null,"pocket":"esm-apps"}]}],"notices_ids":["USN-4843-1"],"notices":[{"id":"USN-4843-1","title":"phpMyAdmin vulnerabilities","summary":"Several security issues were fixed in phpMyAdmin.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2021-03-16T14:27:57.040177","description":"Javier Nieto and Andres Rojas discovered that phpMyAdmin incorrectly\nmanaged input in the form of passwords. An attacker could use this\nvulnerability to cause a denial-of-service (DoS). This issue only\naffected Ubuntu 14.04 ESM. (CVE-2014-9218)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of database names in the PHP Array export feature.\nAn authenticated attacker could use this vulnerability to run arbitrary\nPHP commands. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6609)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6619)\n\nEmanuel Bronshtein discovered that phpMyadmin failed to properly sanitize\ninput. An authenticated attacker could use this vulnerability to cause a\ndenial-of-service (DoS). This issue only affected Ubuntu 14.04 ESM and\nUbuntu 16.04 ESM. (CVE-2016-6630)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to bypass AllowRoot\nrestrictions and deny rules for usernames. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9849)\n\nEmanuel Bronshtein discovered that phpMyAdmin would allow sensitive\ninformation to be leaked when the argument separator in a URL was\nnot the default & value. An attacker could use this vulnerability to\nobtain the CSRF token of a user. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9866)\n\nIsaac Bennetch discovered that phpMyAdmin was incorrectly restricting\nuser access due to the behavior of the substr function on some PHP\nversions. An attacker could use this vulnerability to bypass login\nrestrictions established for users that have no password set. This\nissue only affected Ubuntu 14.04 ESM. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-18264)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of parameters sent during a table editing operation. An\nattacker could use this vulnerability to trigger an endless recursion\nand cause a denial-of-service (DoS). This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2017-1000014)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput used to generate a web page. An authenticated attacker could use this\nvulnerability to execute CSS injection attacks. This issue only affected\nUbuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-1000015)\n\nIt was discovered that phpMyAdmin incorrectly handled certain input. An\nattacker could use this vulnerability to execute a cross-site scripting (XSS)\nattack via a crafted URL. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2018-7260)\n\nIt was discovered phpMyAdmin incorrectly handled database names. An\nattacker could possibly use this to trigger a cross-site scripting\nattack. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2018-12581)\n\nDaniel Le Gall discovered that phpMyAdmin would expose sensitive\ninformation to unauthorized actors due to an error in its transformation\nfeature. An authenticated attacker could use this vulnerability to leak\nthe contents of a local file. This issue only affected Ubuntu 14.04 ESM\nand Ubuntu 16.04 ESM. (CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this to perform a cross-site scripting attack.\nThis issue only affected Ubuntu 16.04 ESM. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. This issue only affected Ubuntu\n16.04 ESM. (CVE-2019-11768)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 16.04 ESM. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 14.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2019-12922)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2019-6798)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2019-19617)\n\nCSW Research Labs discovered that phpMyAdmin failed to properly sanitize\ninput.  An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 16.04 ESM. (CVE-2020-5504)\n\nGiwan Go and Yelang Lee discovered that phpMyAdmin was vulnerable to an\nXSS attack in the transformation feature. If a victim were to click on a\ncrafted link, an attacker could run malicious JavaScript on the victim's\nsystem. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2020-26934)\n\nAndre Sá discovered that phpMyAdmin incorrectly handled certain SQL\nstatements in the search feature. A remote, authenticated attacker could\nuse this to inject malicious SQL into a query. This issue only affected\nUbuntu 20.04 ESM. (CVE-2020-26935)\n","is_hidden":false,"release_packages":{"trusty":[{"name":"phpmyadmin","version":"4:4.0.10-1ubuntu0.1+esm4","description":"MySQL web administration tool","is_source":true},{"name":"phpmyadmin","version":"4:4.0.10-1ubuntu0.1+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/phpmyadmin","version_link":null,"pocket":"esm-infra"}],"xenial":[{"name":"phpmyadmin","version":"4:4.5.4.1-2ubuntu2.1+esm6","description":"MySQL web administration tool","is_source":true},{"name":"phpmyadmin","version":"4:4.5.4.1-2ubuntu2.1+esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/phpmyadmin","version_link":null,"pocket":"esm-apps"}],"bionic":[{"name":"phpmyadmin","version":"4:4.6.6-5ubuntu0.5+esm1","description":"MySQL web administration tool","is_source":true},{"name":"phpmyadmin","version":"4:4.6.6-5ubuntu0.5+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/phpmyadmin","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"phpmyadmin","version":"4:4.9.5+dfsg1-2ubuntu0.1~esm1","description":"MySQL web administration tool","is_source":true},{"name":"phpmyadmin","version":"4:4.9.5+dfsg1-2ubuntu0.1~esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/phpmyadmin","version_link":null,"pocket":"esm-apps"}]},"type":"USN","cves_ids":["CVE-2019-12922","CVE-2016-6619","CVE-2020-26934","CVE-2019-19617","CVE-2016-9866","CVE-2018-19968","CVE-2018-7260","CVE-2019-11768","CVE-2018-19970","CVE-2019-6798","CVE-2017-1000014","CVE-2017-1000015","CVE-2020-5504","CVE-2018-12581","CVE-2016-6630","CVE-2016-9849","CVE-2020-26935","CVE-2019-12616","CVE-2016-6609","CVE-2014-9218","CVE-2017-18264"]}]},{"id":"CVE-2016-6608","published":"2016-12-11T02:59:00","updated_at":"2025-08-25T22:08:22.811772+00:00","description":"\nXSS issues were discovered in phpMyAdmin. This affects the database\nprivilege check and the \"Remove partitioning\" functionality. Specially\ncrafted database names can trigger the XSS attack. All 4.6.x versions\n(prior to 4.6.4) are affected.","ubuntu_description":"","notes":[{"author":"ratliff","note":"introduced in 4.6.0alpha\nhttps://github.com/phpmyadmin/phpmyadmin/commit/afc8aab04f7c09ea44b04806b426522e5ca830ee"}],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-31/","https://www.cve.org/CVERecord?id=CVE-2016-6608"],"bugs":[""],"patches":{"phpmyadmin":[]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"precise","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6607","published":"2016-12-11T02:59:00","updated_at":"2025-08-26T11:55:44.268386+00:00","description":"\nXSS issues were discovered in phpMyAdmin. This affects Zoom search\n(specially crafted column content can be used to trigger an XSS attack);\nGIS editor (certain fields in the graphical GIS editor are not properly\nescaped and can be used to trigger an XSS attack); Relation view; the\nfollowing Transformations: Formatted, Imagelink, JPEG: Upload,\nRegexValidation, JPEG inline, PNG inline, and transformation wrapper; XML\nexport; MediaWiki export; Designer; When the MySQL server is running with a\nspecially-crafted log_bin directive; Database tab; Replication feature; and\nDatabase search. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior\nto 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-30/","https://www.cve.org/CVERecord?id=CVE-2016-6607"],"bugs":[""],"patches":{"phpmyadmin":[]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"xenial","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"impish","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"hirsute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"lunar","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"cosmic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"disco","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"eoan","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"groovy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"kinetic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"mantic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"oracular","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needed","description":"","component":null,"pocket":"security"},{"release_codename":"plucky","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2016-6606","published":"2016-12-11T02:59:00","updated_at":"2025-08-25T22:08:16.665465+00:00","description":"\nAn issue was discovered in cookie encryption in phpMyAdmin. The decryption\nof the username/password is vulnerable to a padding oracle attack. This can\nallow an attacker who has access to a user's browser cookie file to decrypt\nthe username and password. Furthermore, the same initialization vector (IV)\nis used to hash the username and password stored in the phpMyAdmin cookie.\nIf a user has the same password as their username, an attacker who examines\nthe browser cookie can see that they are the same - but the attacker can\nnot directly decode these values from the cookie as it is still hashed. All\n4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and\n4.0.x versions (prior to 4.0.10.17) are affected.","ubuntu_description":"\nIt was discovered that phpmyadmin incorrectly handled cookie encryption.\nAn attacker with access to cookies could possibly use this to determine\ninformation about user credentials.","notes":[],"codename":null,"priority":"high","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["http://www.phpmyadmin.net/security/PMASA-2016-29/","https://www.cve.org/CVERecord?id=CVE-2016-6606"],"bugs":[""],"patches":{"phpmyadmin":["upstream: https://github.com/phpmyadmin/phpmyadmin/commit/cd682a6"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"artful","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"4:4.0.10-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"released","description":"4:4.5.4.1-2ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"yakkety","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"},{"release_codename":"zesty","status":"not-affected","description":"4:4.6.4+dfsg1-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":59200,"limit":20,"total_results":79316}