UBUNTU-CVE-2019-6799

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP configuration, and the inadvertent ignoring of "options(MYSQLIOPTLOCAL_INFILE" calls.

References

Affected packages

Ubuntu:Pro:14.04:LTS / phpmyadmin

Package

Name: phpmyadmin
Purl: pkg:deb/ubuntu/phpmyadmin@4:4.0.10-1ubuntu0.1+esm4?arch=source&distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4:4.*

4:4.0.6-1

4:4.0.8-1

4:4.0.9-1

4:4.0.10-1

4:4.0.10-1ubuntu0.1

4:4.0.10-1ubuntu0.1+esm1

4:4.0.10-1ubuntu0.1+esm2

4:4.0.10-1ubuntu0.1+esm3

4:4.0.10-1ubuntu0.1+esm4

Ubuntu:Pro:16.04:LTS / phpmyadmin

Package

Name: phpmyadmin
Purl: pkg:deb/ubuntu/phpmyadmin@4:4.5.4.1-2ubuntu2.1+esm6?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4:4.*

4:4.4.13.1-1

4:4.5.0.2-2

4:4.5.1-1

4:4.5.1-2

4:4.5.1-3

4:4.5.2-1

4:4.5.2-2

4:4.5.3.1-1

4:4.5.4-1

4:4.5.4.1-2

4:4.5.4.1-2ubuntu1

4:4.5.4.1-2ubuntu2

4:4.5.4.1-2ubuntu2.1

4:4.5.4.1-2ubuntu2.1+esm2

4:4.5.4.1-2ubuntu2.1+esm3

4:4.5.4.1-2ubuntu2.1+esm4

4:4.5.4.1-2ubuntu2.1+esm5

4:4.5.4.1-2ubuntu2.1+esm6

Ubuntu:18.04:LTS / phpmyadmin

Package

Name: phpmyadmin
Purl: pkg:deb/ubuntu/phpmyadmin@4:4.6.6-5ubuntu0.5?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4:4.6.6-5ubuntu0.5

Affected versions

4:4.*

4:4.6.6-5

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "4:4.6.6-5ubuntu0.5",
            "binary_name": "phpmyadmin"
        }
    ],
    "availability": "No subscription required"
}