Debian LTS: Security Advisory for phpmyadmin (DLA-2413-1)

The remote host is missing an update for the 'phpmyadmin' package(s) announced via the DLA-2413-1 advisory.

Several vulnerabilities were found in package phpmyadmin. CVE-2019-19617 phpMyAdmin does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes /Footer.php. CVE-2020-26934 A vulnerability was discovered where an attacker can cause an XSS attack through the transformation feature. If an attacker sends a crafted link to the victim with the malicious JavaScript, when the victim clicks on the link, the JavaScript will run and complete the instructions made by the attacker. CVE-2020-26935 An SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.

'phpmyadmin' package(s) on Debian Linux.

Checks if a vulnerable package version is present on the target host.

For Debian 9 stretch, these problems have been fixed in version 4.6.6-4+deb9u2. We recommend that you upgrade your phpmyadmin packages.