CVE-2016-2042: Infoleak
Published Feb 20, 2016
·Updated
phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message.
Affected Software
32 affected components
openSUSE Leap=42.1
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Fedoraproject Fedora=22
Fedoraproject Fedora=23
phpMyAdmin phpMyAdmin=4.4.1
phpMyAdmin phpMyAdmin=4.4.1.1
phpMyAdmin phpMyAdmin=4.4.2
phpMyAdmin phpMyAdmin=4.4.3
phpMyAdmin phpMyAdmin=4.4.4
phpMyAdmin phpMyAdmin=4.4.5
phpMyAdmin phpMyAdmin=4.4.6
phpMyAdmin phpMyAdmin=4.4.6.1
phpMyAdmin phpMyAdmin=4.4.7
phpMyAdmin phpMyAdmin=4.4.8
phpMyAdmin phpMyAdmin=4.4.9
phpMyAdmin phpMyAdmin=4.4.10
phpMyAdmin phpMyAdmin=4.4.11
phpMyAdmin phpMyAdmin=4.4.12
phpMyAdmin phpMyAdmin=4.4.13
phpMyAdmin phpMyAdmin=4.4.13.1
phpMyAdmin phpMyAdmin=4.4.14.1
phpMyAdmin phpMyAdmin=4.4.15
phpMyAdmin phpMyAdmin=4.4.15.1
phpMyAdmin phpMyAdmin=4.4.15.2
phpMyAdmin phpMyAdmin=4.4.15.3
phpMyAdmin phpMyAdmin=4.5.0
phpMyAdmin phpMyAdmin=4.5.0.1
phpMyAdmin phpMyAdmin=4.5.0.2
phpMyAdmin phpMyAdmin=4.5.1
phpMyAdmin phpMyAdmin=4.5.2
phpMyAdmin phpMyAdmin=4.5.3
Remediation
Event History
Feb 20, 2016
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2042?
CVE-2016-2042 has a medium severity rating as it allows remote attackers to reveal sensitive information.
2
How do I fix CVE-2016-2042?
To fix CVE-2016-2042, upgrade phpMyAdmin to version 4.4.15.3 or 4.5.4 or later.
3
Which versions of phpMyAdmin are affected by CVE-2016-2042?
CVE-2016-2042 affects phpMyAdmin versions 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4.
4
What types of information can be exposed due to CVE-2016-2042?
CVE-2016-2042 can expose the full path of the phpMyAdmin installation in error messages.
5
What systems are vulnerable to CVE-2016-2042?
CVE-2016-2042 affects phpMyAdmin deployed on various systems including openSUSE and Fedora.