Test ID:	1.3.6.1.4.1.25623.1.0.703382
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 3382-1 (phpmyadmin - security update)
Summary:	Several issues have been fixed;in phpMyAdmin, the web administration tool for MySQL.;;CVE-2014-8958 (Wheezy only);;Multiple cross-site scripting (XSS) vulnerabilities.;;CVE-2014-9218 (Wheezy only);;Denial of service (resource consumption) via a long password.;;CVE-2015-2206;Risk of BREACH attack due to reflected parameter.;;CVE-2015-3902;XSRF/CSRF vulnerability in phpMyAdmin setup.;;CVE-2015-3903 (Jessie only);;Vulnerability allowing man-in-the-middle attack on API call to GitHub.;;CVE-2015-6830 (Jessie only);;Vulnerability that allows bypassing the reCaptcha test.;;CVE-2015-7873 (Jessie only);;Content spoofing vulnerability when redirecting user to an;external site.
Description:	Summary: Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL. CVE-2014-8958 (Wheezy only) Multiple cross-site scripting (XSS) vulnerabilities. CVE-2014-9218 (Wheezy only) Denial of service (resource consumption) via a long password. CVE-2015-2206 Risk of BREACH attack due to reflected parameter. CVE-2015-3902 XSRF/CSRF vulnerability in phpMyAdmin setup. CVE-2015-3903 (Jessie only) Vulnerability allowing man-in-the-middle attack on API call to GitHub. CVE-2015-6830 (Jessie only) Vulnerability that allows bypassing the reCaptcha test. CVE-2015-7873 (Jessie only) Content spoofing vulnerability when redirecting user to an external site. Affected Software/OS: phpmyadmin on Debian Linux Solution: For the oldstable distribution (wheezy), these problems have been fixed in version 4:3.4.11.1-2+deb7u2. For the stable distribution (jessie), these problems have been fixed in version 4:4.2.12-2+deb8u1. For the unstable distribution (sid), these problems have been fixed in version 4:4.5.1-1. We recommend that you upgrade your phpmyadmin packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-8958 BugTraq ID: 71243 http://www.securityfocus.com/bid/71243 Debian Security Information: DSA-3382 (Google Search) http://www.debian.org/security/2015/dsa-3382 https://security.gentoo.org/glsa/201505-03 http://www.mandriva.com/security/advisories?name=MDVSA-2014:228 SuSE Security Announcement: openSUSE-SU-2014:1561 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html Common Vulnerability Exposure (CVE) ID: CVE-2014-9218 BugTraq ID: 71434 http://www.securityfocus.com/bid/71434 http://www.mandriva.com/security/advisories?name=MDVSA-2014:243 XForce ISS Database: phpmyadmin-cve20149218-dos(99140) https://exchange.xforce.ibmcloud.com/vulnerabilities/99140 Common Vulnerability Exposure (CVE) ID: CVE-2015-2206 BugTraq ID: 72949 http://www.securityfocus.com/bid/72949 http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:186 http://www.securitytracker.com/id/1031871 SuSE Security Announcement: openSUSE-SU-2015:1191 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html Common Vulnerability Exposure (CVE) ID: CVE-2015-3902 BugTraq ID: 74657 http://www.securityfocus.com/bid/74657 http://www.securitytracker.com/id/1032404 Common Vulnerability Exposure (CVE) ID: CVE-2015-3903 BugTraq ID: 74660 http://www.securityfocus.com/bid/74660 Bugtraq: 20150514 phpMyAdmin 4.4.6 Man-In-the-Middle API Github (Google Search) http://www.securityfocus.com/archive/1/535547/100/0/threaded http://cxsecurity.com/issue/WLB-2015050095 http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html http://www.securitytracker.com/id/1032403 Common Vulnerability Exposure (CVE) ID: CVE-2015-6830 BugTraq ID: 76674 http://www.securityfocus.com/bid/76674 http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html http://www.securitytracker.com/id/1033546 Common Vulnerability Exposure (CVE) ID: CVE-2015-7873 BugTraq ID: 77299 http://www.securityfocus.com/bid/77299 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169987.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171311.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171326.html http://www.securitytracker.com/id/1034013
Copyright	Copyright (C) 2015 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.