Security update for phpMyAdmin SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:0663-1 Final 1 1 2016-03-06T10:05:27Z current 2016-03-06T10:05:27Z 2016-03-06T10:05:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for phpMyAdmin This update to phpMyAdmin 4.4.15.4 fixes the following security issues: - CVE-2016-2560: Multiple XSS vulnerabilities (PMASA-2016-11 boo#968938) - CVE-2016-2561: Multiple XSS vulnerabilities (PMASA-2016-12 boo#968941) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html E-Mail link for openSUSE-SU-2016:0663-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.1 phpMyAdmin-4.4.15.5-16.1 phpMyAdmin-4.4.15.5-16.1 as a component of openSUSE Leap 42.1 Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Host HTTP header, related to libraries/Config.class.php; (2) crafted JSON data, related to file_echo.php; (3) a crafted SQL query, related to js/functions.js; (4) the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or (5) the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page. CVE-2016-2560 openSUSE Leap 42.1:phpMyAdmin-4.4.15.5-16.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html https://www.suse.com/security/cve/CVE-2016-2560.html CVE-2016-2560 https://bugzilla.suse.com/968938 SUSE Bug 968938 Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via (1) normalization.php or (2) js/normalization.js in the database normalization page, (3) templates/database/structure/sortable_header.phtml in the database structure page, or (4) the pos parameter to db_central_columns.php in the central columns page. CVE-2016-2561 openSUSE Leap 42.1:phpMyAdmin-4.4.15.5-16.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html https://www.suse.com/security/cve/CVE-2016-2561.html CVE-2016-2561 https://bugzilla.suse.com/968941 SUSE Bug 968941