deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9120
Published: 2016-12-08
Description: Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264, CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9590232bb4f4cc824f3425a6e1349afbe6d6d2b7; http://source.android.com/security/bulletin/2016-12-01.html; http://www.securityfocus.com/bid/94669
CVE: CVE-2016-8858
Published: 2016-12-09
Description: The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests.  NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c.diff?r1=1.126&r2=1.127&f=h; http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c?rev=1.127&content-type=text/x-cvsweb-markup; http://www.openwall.com/lists/oss-security/2016/10/19/3
CVE: CVE-2015-8786
Published: 2016-12-09
Description: The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service (resource consumption) via the (1) lengths_age or (2) lengths_incr parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2017-0226.html; http://rhn.redhat.com/errata/RHSA-2017-0530.html; http://rhn.redhat.com/errata/RHSA-2017-0531.html
CVE: CVE-2016-6301
Published: 2016-12-09
Description: The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-835
References: http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html; http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html; http://seclists.org/fulldisclosure/2019/Jun/18
CVE: CVE-2016-6523
Published: 2016-12-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) q or (2) link_type parameter to admin/media.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/08/02/13; http://www.openwall.com/lists/oss-security/2016/08/02/3; http://www.securityfocus.com/bid/92272
CVE: CVE-2016-6829
Published: 2016-12-09
Description: The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.openwall.com/lists/oss-security/2016/08/16/1; http://www.openwall.com/lists/oss-security/2016/08/18/9; http://www.securityfocus.com/bid/92476
CVE: CVE-2016-9013
Published: 2016-12-09
Description: Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.debian.org/security/2017/dsa-3835; http://www.securityfocus.com/bid/94069; http://www.securitytracker.com/id/1037159
CVE: CVE-2016-9014
Published: 2016-12-09
Description: Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
CVSS Score: 8.1 (HIGH)
CWE: CWE-264
References: http://www.debian.org/security/2017/dsa-3835; http://www.securityfocus.com/bid/94068; http://www.securitytracker.com/id/1037159
CVE: CVE-2016-6321
Published: 2016-12-09
Description: Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d; http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html; http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html
CVE: CVE-2016-6496
Published: 2016-12-09
Description: The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/539655/100/0/threaded; http://www.securityfocus.com/bid/93826; https://confluence.atlassian.com/crowd/crowd-security-advisory-2016-10-19-856697283.html
CVE: CVE-2016-6501
Published: 2016-12-09
Description: JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94855; https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf; https://www.jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-MainUpdates.7
CVE: CVE-2016-9101
Published: 2016-12-09
Description: Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-772
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html; http://www.openwall.com/lists/oss-security/2016/10/27/14; http://www.openwall.com/lists/oss-security/2016/10/30/5
CVE: CVE-2016-9102
Published: 2016-12-09
Description: Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-772
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ff55e94d23ae94c8628b[PII_REDACTED]c763eb3e06; http://www.openwall.com/lists/oss-security/2016/10/27/15; http://www.openwall.com/lists/oss-security/2016/10/30/6
CVE: CVE-2016-9103
Published: 2016-12-09
Description: The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-200
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb687602853b4ae656e9236ee4222609f3a6887d; http://www.openwall.com/lists/oss-security/2016/10/28/1; http://www.openwall.com/lists/oss-security/2016/10/30/7
CVE: CVE-2016-9104
Published: 2016-12-09
Description: Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html; http://www.openwall.com/lists/oss-security/2016/10/28/2; http://www.openwall.com/lists/oss-security/2016/10/30/8
CVE: CVE-2016-9105
Published: 2016-12-09
Description: Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-772
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4c1586787ff43c9acd18a56c12d720e3e6be9f7c; http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html; http://www.openwall.com/lists/oss-security/2016/10/28/3
CVE: CVE-2016-9106
Published: 2016-12-09
Description: Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-772
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fdfcc9aeea1492f4b819a24c94dfb678145b1bf9; http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html; http://www.openwall.com/lists/oss-security/2016/10/28/4
CVE: CVE-2016-5423
Published: 2016-12-09
Description: PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
CVSS Score: 8.3 (HIGH)
CWE: CWE-476
References: http://rhn.redhat.com/errata/RHSA-2016-1781.html; http://rhn.redhat.com/errata/RHSA-2016-1820.html; http://rhn.redhat.com/errata/RHSA-2016-1821.html
CVE: CVE-2016-5424
Published: 2016-12-09
Description: PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94
References: http://rhn.redhat.com/errata/RHSA-2016-1781.html; http://rhn.redhat.com/errata/RHSA-2016-1820.html; http://rhn.redhat.com/errata/RHSA-2016-1821.html
CVE: CVE-2016-4964
Published: 2016-12-10
Description: The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state.
CVSS Score: 6.0 (MEDIUM)
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=06630554ccbdd25780aa03c3548aaff1eb56dffd; http://www.openwall.com/lists/oss-security/2016/05/24/4; http://www.openwall.com/lists/oss-security/2016/05/24/7
CVE: CVE-2016-6490
Published: 2016-12-10
Description: The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-120
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1e7aed70144b4673fc26e73062064b6724795e5f; http://www.openwall.com/lists/oss-security/2016/07/28/4; http://www.openwall.com/lists/oss-security/2016/07/28/9
CVE: CVE-2016-6833
Published: 2016-12-10
Description: Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6c352ca9b4ee3e1e286ea9e8434bd8e69ac7d0d8; http://www.openwall.com/lists/oss-security/2016/08/12/1; http://www.openwall.com/lists/oss-security/2016/08/18/3
CVE: CVE-2016-6834
Published: 2016-12-10
Description: The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-120
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05; http://www.openwall.com/lists/oss-security/2016/08/11/8; http://www.openwall.com/lists/oss-security/2016/08/18/7
CVE: CVE-2016-6835
Published: 2016-12-10
Description: The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.
CVSS Score: 6.0 (MEDIUM)
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=93060258ae748573ca[PII_REDACTED]a[PII_REDACTED]d; http://www.openwall.com/lists/oss-security/2016/08/11/7; http://www.openwall.com/lists/oss-security/2016/08/18/4
CVE: CVE-2016-6836
Published: 2016-12-10
Description: The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-665
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fdda170e50b8af062cf5741e12c4fb5e57a2eacf; http://www.openwall.com/lists/oss-security/2016/08/11/5; http://www.openwall.com/lists/oss-security/2016/08/18/5
CVE: CVE-2016-6888
Published: 2016-12-10
Description: Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=47882fa4975bf0b58dd74474329fdd7154e8f04c; http://www.openwall.com/lists/oss-security/2016/08/19/10; http://www.openwall.com/lists/oss-security/2016/08/19/6
CVE: CVE-2016-7116
Published: 2016-12-10
Description: Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=56f101ecce0eafd09e2daf1c4eeb1377d6959261; http://www.openwall.com/lists/oss-security/2016/08/30/1; http://www.openwall.com/lists/oss-security/2016/08/30/3
CVE: CVE-2016-7155
Published: 2016-12-10
Description: hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds access or infinite loop, and QEMU process crash) via a crafted page count for descriptor rings.
CVSS Score: 4.4 (MEDIUM)
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7f61f4690dd153be98900a2a508b88989e692753; http://www.openwall.com/lists/oss-security/2016/09/06/2; http://www.openwall.com/lists/oss-security/2016/09/07/1
CVE: CVE-2016-7156
Published: 2016-12-10
Description: The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-704
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=49adc5d3f8c6bb75e55ebfeab109c5c37dea65e8; http://www.openwall.com/lists/oss-security/2016/09/06/3; http://www.openwall.com/lists/oss-security/2016/09/07/2
CVE: CVE-2016-7157
Published: 2016-12-10
Description: The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_ioc_0 functions in hw/scsi/mptconfig.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via vectors involving MPTSAS_CONFIG_PACK.
CVSS Score: 4.4 (MEDIUM)
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=65a8e1f6413a0f6f79894da710b5d6d43361d27d; http://www.openwall.com/lists/oss-security/2016/09/06/4; http://www.openwall.com/lists/oss-security/2016/09/07/3
CVE: CVE-2016-7170
Published: 2016-12-10
Description: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-129
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=167d97a3def77ee2dbf6e908b0ecbfe2103977db; http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html; http://www.openwall.com/lists/oss-security/2016/09/09/4
CVE: CVE-2016-7421
Published: 2016-12-10
Description: The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-834
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d251157ac1928191af851d199a9ff255d330bec9; http://www.openwall.com/lists/oss-security/2016/09/16/3; http://www.openwall.com/lists/oss-security/2016/09/16/9
CVE: CVE-2016-7422
Published: 2016-12-10
Description: The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-120
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=973e7170dddefb491a48df5cba33b2ae151013a0; http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html; http://www.openwall.com/lists/oss-security/2016/09/16/10
CVE: CVE-2016-7466
Published: 2016-12-10
Description: Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-772
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b53dd4495ced2432a0b652ea895e651d07336f7e; http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html; http://www.openwall.com/lists/oss-security/2016/09/19/8
CVE: CVE-2016-7994
Published: 2016-12-10
Description: Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-772
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html; http://www.openwall.com/lists/oss-security/2016/10/07/2; http://www.openwall.com/lists/oss-security/2016/10/08/3
CVE: CVE-2016-7995
Published: 2016-12-10
Description: Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-772
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b16c129daf0fed91febbb88de23dae8271c8898a; http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html; http://www.openwall.com/lists/oss-security/2016/10/07/3
CVE: CVE-2016-9832
Published: 2016-12-10
Description: PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS, as demonstrated by WEBGUI or Report.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-74
References: http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html; http://seclists.org/fulldisclosure/2016/Dec/33; http://www.securityfocus.com/archive/1/539883/100/0/threaded
CVE: CVE-2016-4412
Published: 2016-12-11
Description: An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/94519; https://security.gentoo.org/glsa/201701-32; https://www.phpmyadmin.net/security/PMASA-2016-57
CVE: CVE-2016-6606
Published: 2016-12-11
Description: An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200, CWE-310
References: http://www.securityfocus.com/bid/94114; https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html; https://security.gentoo.org/glsa/201701-32
CVE: CVE-2016-6607
Published: 2016-12-11
Description: XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack); Relation view; the following Transformations: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline, and transformation wrapper; XML export; MediaWiki export; Designer; When the MySQL server is running with a specially-crafted log_bin directive; Database tab; Replication feature; and Database search. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93257; https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html; https://security.gentoo.org/glsa/201701-32
CVE: CVE-2016-6608
Published: 2016-12-11
Description: XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93258; https://security.gentoo.org/glsa/201701-32; https://www.phpmyadmin.net/security/PMASA-2016-31
CVE: CVE-2016-6609
Published: 2016-12-11
Description: An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/94112; https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html; https://security.gentoo.org/glsa/201701-32