UBUNTU-CVE-2016-9847
- Source
- https://ubuntu.com/security/CVE-2016-9847
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-9847.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2016-9847
- Upstream
- Published
- 2016-12-11T02:59:00Z
- Modified
- 2025-07-18T16:43:41Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
An issue was discovered in phpMyAdmin. When the user does not specify a blowfishsecret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user's blowfishsecret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
- References
Affected packages
Ubuntu:Pro:14.04:LTS / phpmyadmin
Package
- Name
- phpmyadmin
- Purl
- pkg:deb/ubuntu/phpmyadmin@4:4.0.10-1ubuntu0.1+esm4?arch=source&distro=esm-infra-legacy/trusty
Ubuntu:Pro:16.04:LTS / phpmyadmin
Package
- Name
- phpmyadmin
- Purl
- pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm6?arch=source&distro=esm-apps/xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
4:4.*
4:4.4.13.1-1
4:4.5.0.2-2
4:4.5.1-1
4:4.5.1-2
4:4.5.1-3
4:4.5.2-1
4:4.5.2-2
4:4.5.3.1-1
4:4.5.4-1
4:4.5.4.1-2
4:4.5.4.1-2ubuntu1
4:4.5.4.1-2ubuntu2
4:4.5.4.1-2ubuntu2.1
4:4.5.4.1-2ubuntu2.1+esm2
4:4.5.4.1-2ubuntu2.1+esm3
4:4.5.4.1-2ubuntu2.1+esm4
4:4.5.4.1-2ubuntu2.1+esm5
4:4.5.4.1-2ubuntu2.1+esm6