openSUSE Security Update : phpMyAdmin (openSUSE-SU-2013:1065-1)

Medium Nessus Plugin ID 75055


The remote openSUSE host is missing a security update.


This update of phpMyAdmin fixes several security issues.

- update to (2013-04-24)

- [security] Remote code execution (preg_replace), reported by Janek Vind (see PMASA-2013-2)

- [security] Locally Saved SQL Dump File Multiple File Extension Remote Code Execution, reported by Janek Vind (see PMASA-2013-3)

- fix for bnc#824301

- PMASA-2013-2 (CVE-2013-3238)

- fix for bnc#824302

- PMASA-2013-3 (CVE-2013-3239)

- update to 3.5.8 (2013-04-08)

- sf#3828 MariaDB reported as MySQL

- sf#3854 Incorrect header for Safari 6.0

- sf#3705 Attempt to open trigger for edit gives NULL


- [security] Self-XSS on GIS visualisation page, reported by Janek Vind see PMASA-2013-1

- sf#3800 Incorrect keyhandler behaviour #2

- fix for bnc#814678

- PMASA-2013-1 (CVE-2013-1937)


Update the affected phpMyAdmin package.

See Also

Plugin Details

Severity: Medium

ID: 75055

File Name: openSUSE-2013-524.nasl

Version: $Revision: 1.3 $

Type: local

Agent: unix

Published: 2014/06/13

Modified: 2016/12/07

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P


Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:phpMyAdmin, cpe:/o:novell:opensuse:12.2, cpe:/o:novell:opensuse:12.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2013/06/13

Exploitable With

Core Impact

Metasploit (phpMyAdmin Authenticated Remote Code Execution via preg_replace())

Reference Information

CVE: CVE-2013-1937, CVE-2013-3238, CVE-2013-3239