phpmyadmin: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.2138
                        phpmyadmin security update
                               18 June 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           phpmyadmin
Publisher:         Debian
Operating System:  Debian GNU/Linux 8
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                   Access Privileged Data          -- Remote with User Interaction
                   Cross-site Request Forgery      -- Remote with User Interaction
                   Cross-site Scripting            -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-12616 CVE-2016-9864 CVE-2016-9861
                   CVE-2016-9850 CVE-2016-9849 CVE-2016-6632
                   CVE-2016-6631 CVE-2016-6630 CVE-2016-6628
                   CVE-2016-6627 CVE-2016-6626 CVE-2016-6624
                   CVE-2016-6613 CVE-2016-6612 CVE-2016-6611
                   CVE-2016-6607 CVE-2016-6606 

Reference:         ESB-2019.2016
                   ESB-2017.0215

Original Bulletin: 
   https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Package        : phpmyadmin
Version        : 4:4.2.12-2+deb8u6
CVE ID         : CVE-2016-6606 CVE-2016-6607 CVE-2016-6611 CVE-2016-6612
                 CVE-2016-6613 CVE-2016-6624 CVE-2016-6626 CVE-2016-6627
                 CVE-2016-6628 CVE-2016-6630 CVE-2016-6631 CVE-2016-6632
                 CVE-2016-9849 CVE-2016-9850 CVE-2016-9861 CVE-2016-9864
                 CVE-2019-12616
Debian Bug     : 930017

Multiple security vulnerabilities were fixed in phpmyadmin, a MySQL web
administration tool, which prevent possible SQL injection attacks, CSRF,
the bypass of user restrictions, information disclosure or
denial-of-service.

For Debian 8 "Jessie", these problems have been fixed in version
4:4.2.12-2+deb8u6.

We recommend that you upgrade your phpmyadmin packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXQgcwWaOgq3Tt24GAQgnAA//d7xtabMr9ZiPb+sk8kcqWoBEpwHMZrEG
EzeQn+TPHvj3ZJTwUs/AB/r/aJLXZhJBOM3aiQovVPTtWk1cSwHLCpwDmkMH7Y/5
ARE8NWMOQCH2DGfFwL2WUyn00RAiuX4JNfFT7jqssh5mkbOFakYRBu/pI+wKfTwY
HEZP5zvZqd3w9isImdbo6rxA+DVyPaeXs2UKWj/ldQw1bGI/OL+fRrZ+J3EsLX6c
3QfCQdTobeCYcG82cTKvJdjtBhGucAKg4ZUAGA1o+g1CHAmKyEUt/arE9hqcH/oJ
iClb0GLOy2Rj7tIcgqVlwVnCC/WxCHn3QFYAXawDO+feXPlnkZoiC9AbECM6dutN
PLMTVpiKUF5R9QqIvnUOW03yHqUJmeFIFmAIXHkJQq71Wwxq37Ar4P0cskvVPSgN
YU/pgNK7S6g5QCdNQeEvfNO6hifvvMfqv530fLjK0Qc4xymjYkGNkBlD+JCobEOq
5eabZzaVN//Ezv9bYrkUmZ8tJO9Hu3rHke0xOlvTHOdI4sDeEDcXkMM90JCF+y2x
sE2af+TwCeEKPAfGjuNeW8hjrvgY/tzJNBIKmhnRFZnux2EqbOgnY3ZrC6+UENCY
ESCQnppV3lrhCmLgJhlkZQHM+9EieWIKfBqVFhXke4DYrArDZytN8sj5Steco9HI
3e9RAa1fG7g=
=aQXD
-----END PGP SIGNATURE-----