phpMyAdmin 4.6.5.1 (2016-11-26) ===============================

A patch-level release fixing two small issues :

  - an issue affecting a small number of users using     $cfg['Servers'][$i]['hide_db'] or     $cfg['Servers'][$i]['only_db'].

  - an issue affecting the create table dialog where the     partition selection tool was overzealous and made it     difficult to create a new table.

There are also minor improvements to the Czech language file.

phpMyAdmin 4.6.5 (2016-11-25) =============================

A release containing security fixes and bug fixes. Aside from the security improvements, many bugs have been fixed including :

  - Fix for expanding in navigation pane

  - Reintroduced a simplified version of PmaAbsoluteUri     directive (needed with reverse proxies)

  - Fix editing of ENUM/SET/DECIMAL field structures

  - Improvements to the parser

And many, many more. Please see the ChangeLog for full details of bugs fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various security issues where found and fixed in phpmyadmin in wheezy.

CVE-2016-4412 / PMASA-2016-57

A user can be tricked in following a link leading to phpMyAdmin, which after authentication redirects to another malicious site.

CVE-2016-6626 / PMASA-2016-49

In the fix for PMASA-2016-57, we didn't have sufficient checking and was possible to bypass whitelist.

CVE-2016-9849 / PMASA-2016-60

Username deny rules bypass (AllowRoot & Others) by using Null Byte.

CVE-2016-9850 / PMASA-2016-61

Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time.

CVE-2016-9861 / PMASA-2016-66

In the fix for PMASA-2016-49, we has buggy checks and was possible to bypass whitelist.

CVE-2016-9864 / PMASA-2016-69

Multiple SQL injection vulnerabilities.

CVE-2016-9865 / PMASA-2016-70

Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function.

For Debian 7 'Wheezy', these problems have been fixed in version 4:3.4.11.1-2+deb7u7.

We recommend that you upgrade your phpmyadmin packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin,     which after authentication redirects to another malicious site. The attacker must sniff the user's valid     phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected. (CVE-2016-4412)

Note that Nessus relies on the presence of the package as reported by the vendor.

Please reference CVE/URL list for details

The remote host is affected by the vulnerability described in GLSA-201701-32 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers referenced below for details.
  Impact :

    A authenticated remote attacker could exploit these vulnerabilities to       execute arbitrary PHP Code, inject SQL code, or to conduct Cross-Site       Scripting attacks.
    In certain configurations, an unauthenticated remote attacker could       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
95670	Fedora 24 : phpMyAdmin (2016-2424eeca35)	Nessus	Fedora Local Security Checks	12/12/2016	1/14/2026	medium
95490	Fedora 25 : phpMyAdmin (2016-6576a8536b)	Nessus	Fedora Local Security Checks	12/5/2016	1/15/2026	medium
96093	Debian DLA-757-1 : phpmyadmin security update	Nessus	Debian Local Security Checks	12/27/2016	1/7/2026	critical
254231	Linux Distros Unpatched Vulnerability : CVE-2016-4412	Nessus	Misc.	8/24/2025	8/24/2025	medium
95364	FreeBSD : phpMyAdmin -- multiple vulnerabilities (6fe72178-b2e3-11e6-8b2a-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	11/28/2016	1/16/2026	high
95613	Fedora 23 : phpMyAdmin (2016-7fc142da66)	Nessus	Fedora Local Security Checks	12/8/2016	1/15/2026	medium
96426	GLSA-201701-32 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/12/2017	1/6/2026	critical

Detections

Analytics

Plugins Search

medium

medium

critical

medium

high

medium

critical