Description

An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Remediation

References

CVE-2016-6620

Related Vulnerabilities

WordPress Plugin Portfolio Gallery-Photo Gallery Cross-Site Scripting (2.1.10)

Apache HTTP Server Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2009-3560)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4572)

Oracle JRE CVE-2014-0460 Vulnerability (CVE-2014-0460)

Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0276)

Severity

Critical

Classification

CVE-2016-6620 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities