Debian Security Advisory

DLA-757-1 phpmyadmin -- LTS security update

Date Reported:
24 Dec 2016
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2016-4412, CVE-2016-6626, CVE-2016-9849, CVE-2016-9850, CVE-2016-9861, CVE-2016-9864, CVE-2016-9865.
More information:

Various security issues where found and fixed in phpmyadmin in wheezy.

  • CVE-2016-4412 / PMASA-2016-57

    A user can be tricked in following a link leading to phpMyAdmin, which after authentication redirects to another malicious site.

  • CVE-2016-6626 / PMASA-2016-49

    In the fix for PMASA-2016-57, we didn't have sufficient checking and was possible to bypass whitelist.

  • CVE-2016-9849 / PMASA-2016-60

    Username deny rules bypass (AllowRoot & Others) by using Null Byte.

  • CVE-2016-9850 / PMASA-2016-61

    Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time.

  • CVE-2016-9861 / PMASA-2016-66

    In the fix for PMASA-2016-49, we has buggy checks and was possible to bypass whitelist.

  • CVE-2016-9864 / PMASA-2016-69

    Multiple SQL injection vulnerabilities.

  • CVE-2016-9865 / PMASA-2016-70

    Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function.

For Debian 7 Wheezy, these problems have been fixed in version 4:

We recommend that you upgrade your phpmyadmin packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: