Security update for phpMyAdmin SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:4124-1 Final 1 1 2018-12-14T13:16:06Z current 2018-12-14T13:16:06Z 2018-12-14T13:16:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for phpMyAdmin This update for phpMyAdmin fixes security issues and bugs. Security issues addressed in the 4.8.4 release (bsc#1119245): - CVE-2018-19968: Local file inclusion through transformation feature - CVE-2018-19969: XSRF/CSRF vulnerability - CVE-2018-19970: XSS vulnerability in navigation tree This update also contains the following upstream bug fixes and improvements: - Ensure that database names with a dot ('.') are handled properly when DisableIS is true - Fix for message "Error while copying database (pma__column_info)" - Move operation causes "SELECT * FROM `undefined`" error - When logging with $cfg['AuthLog'] to syslog, successful login messages were not logged when $cfg['AuthLogSuccess'] was true - Multiple errors and regressions with Designer The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00032.html E-Mail link for openSUSE-SU-2018:4124-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Package Hub for SUSE Linux Enterprise 12 SUSE Package Hub for SUSE Linux Enterprise 15 phpMyAdmin-4.8.4-bp150.3.6.1 phpMyAdmin-4.8.4-bp150.3.6.1 as a component of SUSE Package Hub for SUSE Linux Enterprise 12 phpMyAdmin-4.8.4-bp150.3.6.1 as a component of SUSE Package Hub for SUSE Linux Enterprise 15 An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system. CVE-2018-19968 SUSE Package Hub for SUSE Linux Enterprise 12:phpMyAdmin-4.8.4-bp150.3.6.1 SUSE Package Hub for SUSE Linux Enterprise 15:phpMyAdmin-4.8.4-bp150.3.6.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00032.html https://www.suse.com/security/cve/CVE-2018-19968.html CVE-2018-19968 https://bugzilla.suse.com/1119245 SUSE Bug 1119245 phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc. CVE-2018-19969 SUSE Package Hub for SUSE Linux Enterprise 12:phpMyAdmin-4.8.4-bp150.3.6.1 SUSE Package Hub for SUSE Linux Enterprise 15:phpMyAdmin-4.8.4-bp150.3.6.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00032.html https://www.suse.com/security/cve/CVE-2018-19969.html CVE-2018-19969 https://bugzilla.suse.com/1119245 SUSE Bug 1119245 In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name. CVE-2018-19970 SUSE Package Hub for SUSE Linux Enterprise 12:phpMyAdmin-4.8.4-bp150.3.6.1 SUSE Package Hub for SUSE Linux Enterprise 15:phpMyAdmin-4.8.4-bp150.3.6.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00032.html https://www.suse.com/security/cve/CVE-2018-19970.html CVE-2018-19970 https://bugzilla.suse.com/1119245 SUSE Bug 1119245