Advisories ยป MGASA-2016-0051

Updated phpmyadmin/phpseclib packages fix security vulnerability

Publication date: 05 Feb 2016
Modification date: 05 Feb 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-1927 , CVE-2016-2038 , CVE-2016-2039 , CVE-2016-2040 , CVE-2016-2041

Description

Password suggestion functionality uses Math.random() which does not
provide cryptographically secure random numbers (CVE-2016-1927).

By calling some scripts that are part of phpMyAdmin in an unexpected way,
it is possible to trigger phpMyAdmin to display a PHP error message which
contains the full path of the directory where phpMyAdmin is installed
(CVE-2016-2038).

The XSRF/CSRF token is generated with a weak algorithm using functions
that do not return cryptographically secure values (CVE-2016-2039).

With a crafted table name it is possible to trigger an XSS attack in the
database search page. With a crafted SET value or a crafted search query,
it is possible to trigger an XSS attacks in the zoom search page. With a
crafted hostname header, it is possible to trigger an XSS attacks in the
home page (CVE-2016-2040).

The comparison of the XSRF/CSRF token parameter with the value saved in
the session is vulnerable to timing attacks. Moreover, the comparison
could be bypassed if the XSRF/CSRF token matches a particular pattern
(CVE-2016-2041).

The phpmyadmin package has been updated to version 4.4.15.4 in the 4.4.x
stable branch, and the phpseclib dependency has been updated to version
2.0.1.

References

SRPMS

5/core