An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 02:56
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.securityfocus.com/bid/95055 - | |
References | () https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html - | |
References | () https://security.gentoo.org/glsa/201701-32 - | |
References | () https://www.phpmyadmin.net/security/PMASA-2016-43 - Patch, Vendor Advisory |
Information
Published : 2016-12-11 02:59
Updated : 2024-11-21 02:56
NVD link : CVE-2016-6620
Mitre link : CVE-2016-6620
CVE.ORG link : CVE-2016-6620
JSON object : View
Products Affected
phpmyadmin
- phpmyadmin
CWE
CWE-502
Deserialization of Untrusted Data