18 June 2019
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.2138 phpmyadmin security update 18 June 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: phpmyadmin Publisher: Debian Operating System: Debian GNU/Linux 8 Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Access Privileged Data -- Remote with User Interaction Cross-site Request Forgery -- Remote with User Interaction Cross-site Scripting -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2019-12616 CVE-2016-9864 CVE-2016-9861 CVE-2016-9850 CVE-2016-9849 CVE-2016-6632 CVE-2016-6631 CVE-2016-6630 CVE-2016-6628 CVE-2016-6627 CVE-2016-6626 CVE-2016-6624 CVE-2016-6613 CVE-2016-6612 CVE-2016-6611 CVE-2016-6607 CVE-2016-6606 Reference: ESB-2019.2016 ESB-2017.0215 Original Bulletin: https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html - --------------------------BEGIN INCLUDED TEXT-------------------- Package : phpmyadmin Version : 4:4.2.12-2+deb8u6 CVE ID : CVE-2016-6606 CVE-2016-6607 CVE-2016-6611 CVE-2016-6612 CVE-2016-6613 CVE-2016-6624 CVE-2016-6626 CVE-2016-6627 CVE-2016-6628 CVE-2016-6630 CVE-2016-6631 CVE-2016-6632 CVE-2016-9849 CVE-2016-9850 CVE-2016-9861 CVE-2016-9864 CVE-2019-12616 Debian Bug : 930017 Multiple security vulnerabilities were fixed in phpmyadmin, a MySQL web administration tool, which prevent possible SQL injection attacks, CSRF, the bypass of user restrictions, information disclosure or denial-of-service. For Debian 8 "Jessie", these problems have been fixed in version 4:4.2.12-2+deb8u6. We recommend that you upgrade your phpmyadmin packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to email@example.com and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: firstname.lastname@example.org Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXQgcwWaOgq3Tt24GAQgnAA//d7xtabMr9ZiPb+sk8kcqWoBEpwHMZrEG EzeQn+TPHvj3ZJTwUs/AB/r/aJLXZhJBOM3aiQovVPTtWk1cSwHLCpwDmkMH7Y/5 ARE8NWMOQCH2DGfFwL2WUyn00RAiuX4JNfFT7jqssh5mkbOFakYRBu/pI+wKfTwY HEZP5zvZqd3w9isImdbo6rxA+DVyPaeXs2UKWj/ldQw1bGI/OL+fRrZ+J3EsLX6c 3QfCQdTobeCYcG82cTKvJdjtBhGucAKg4ZUAGA1o+g1CHAmKyEUt/arE9hqcH/oJ iClb0GLOy2Rj7tIcgqVlwVnCC/WxCHn3QFYAXawDO+feXPlnkZoiC9AbECM6dutN PLMTVpiKUF5R9QqIvnUOW03yHqUJmeFIFmAIXHkJQq71Wwxq37Ar4P0cskvVPSgN YU/pgNK7S6g5QCdNQeEvfNO6hifvvMfqv530fLjK0Qc4xymjYkGNkBlD+JCobEOq 5eabZzaVN//Ezv9bYrkUmZ8tJO9Hu3rHke0xOlvTHOdI4sDeEDcXkMM90JCF+y2x sE2af+TwCeEKPAfGjuNeW8hjrvgY/tzJNBIKmhnRFZnux2EqbOgnY3ZrC6+UENCY ESCQnppV3lrhCmLgJhlkZQHM+9EieWIKfBqVFhXke4DYrArDZytN8sj5Steco9HI 3e9RAa1fG7g= =aQXD -----END PGP SIGNATURE-----