CVE-2016-9860: Input Validation
An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9860?
CVE-2016-9860 has a severity rating of medium, as it allows for denial of service attacks by unauthenticated users.
How do I fix CVE-2016-9860?
To fix CVE-2016-9860, update phpMyAdmin to version 4.6.5 or later, or apply the appropriate security patch.
What versions of phpMyAdmin are affected by CVE-2016-9860?
CVE-2016-9860 affects phpMyAdmin versions 4.6.x prior to 4.6.5, 4.4.x prior to 4.4.15.9, and 4.0.x prior to 4.0.10.18.
Is CVE-2016-9860 remote exploitable?
Yes, CVE-2016-9860 can be exploited remotely by an unauthenticated user to execute a denial of service attack.
What should I do if I can't update phpMyAdmin to fix CVE-2016-9860?
If unable to update phpMyAdmin, ensure that the configuration does not allow arbitrary server connections by setting $cfg['AllowArbitraryServer'] to false.