Upstream information
Description
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having important severity.
| National Vulnerability Database | |
|---|---|
| Base Score | 5 |
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | None |
| Availability Impact | None |
| National Vulnerability Database | |
|---|---|
| Base Score | 5.3 |
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Access Vector | Network |
| Access Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | Low |
| Integrity Impact | None |
| Availability Impact | None |
- openSUSE-SU-2016:1699-1, published Tue, 28 Jun 2016 22:10:20 +0200 (CEST)
- openSUSE-SU-2016:1700-1, published Wed, 29 Jun 2016 03:07:43 +0200 (CEST)
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| openSUSE 13.1 |
| Patchnames: 2016-806 |
| openSUSE Leap 42.1 |
| Patchnames: openSUSE-2016-804 |
| openSUSE Tumbleweed |
| Patchnames: openSUSE Tumbleweed GA phpMyAdmin |
