Fedora 23 : phpMyAdmin-4.5.4.1-1.fc23 (2016-e55278763e)

Medium Nessus Plugin ID 89630

Synopsis

The remote Fedora host is missing a security update.

Description

phpMyAdmin 4.5.4.1 (2016-01-28) =============================== - Error with PMA 4.4.15.3 - Remove hard dependency on phpseclib phpMyAdmin 4.5.4 (2016-01-28) ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword - Avoid syntax error in JavaScript messages on invalid PHP setting for max_input_vars - Properly handle errors in upacking zip archive - Set PHP's internal encoding to UTF-8 - Fixed Kanji encoding in some specific cases - Check whether iconv works before using it - Avoid conversion of MySQL error messages - Undefined index: parameters - Undefined index:
field_name_orig - Undefined index: host - 'Add to central columns' (per column button) does nothing - SQL duplicate entry error trying to INSERT in designer_settings table - Fix handling of databases with dot in a name - Fix hiding of page content behind menu - FROM clause not generated after loading search bookmark - Fix creating/editing VIEW with DEFINER containing special chars - Do not invoke FLUSH PRIVILEGES when server in --skip- grant-tables - Misleading message for configuration storage - Table pagination does nothing when session expired - Index comments not working properly - Better handle local storage errors - Improve detection of privileges for privilege adjusting - Undefined property: stdClass::$releases at version check when disabled in config - SQL comment and variable stripped from bookmark on save - Gracefully handle errors in regex based JavaScript search - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1 - [Security] Unsafe generation of CSRF token, see PMASA-2016-2 - [Security] Multiple XSS vulnerabilities, see PMASA-2016-3 - [Security] Insecure password generation in JavaScript, see PMASA-2016-4 - [Security] Unsafe comparison of CSRF token, see PMASA-2016-5 - [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6 - [Security] XSS vulnerability in normalization page, see PMASA-2016-7 - [Security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8 - [Security] XSS vulnerability in SQL editor, see PMASA-2016-9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected phpMyAdmin package.

See Also

https://bugzilla.redhat.com/show_bug.cgi?id=1302676

https://bugzilla.redhat.com/show_bug.cgi?id=1302677

https://bugzilla.redhat.com/show_bug.cgi?id=1302679

https://bugzilla.redhat.com/show_bug.cgi?id=1302680

https://bugzilla.redhat.com/show_bug.cgi?id=1302681

https://bugzilla.redhat.com/show_bug.cgi?id=1302682

https://bugzilla.redhat.com/show_bug.cgi?id=1302684

https://bugzilla.redhat.com/show_bug.cgi?id=1302685

https://bugzilla.redhat.com/show_bug.cgi?id=1302686

http://www.nessus.org/u?849850b3

Plugin Details

Severity: Medium

ID: 89630

File Name: fedora_2016-e55278763e.nasl

Version: Revision: 1.3

Type: local

Agent: unix

Published: 2016/03/04

Updated: 2016/10/18

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3.0

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:phpMyAdmin, cpe:/o:fedoraproject:fedora:23

Patch Publication Date: 2016/02/03

Reference Information

CVE: CVE-2016-1927, CVE-2016-2038, CVE-2016-2039, CVE-2016-2040, CVE-2016-2041, CVE-2016-2042, CVE-2016-2043, CVE-2016-2044, CVE-2016-2045