Memory leak in phpMyAdmin - CVE-2018-19968

Vulnerability identifier: #VU16498

CSH Severity: Low

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-19968

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to memory leak. A remote attacker with valid credentials can log in to phpMyAdmin, gain access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access to leak the contents of a local file.

phpMyAdmin
Gentoo Linux
Opensuse
Ubuntu
phpmyadmin (Alpine package)
phpmyadmin (Ubuntu package)
SUSE Package Hub for SUSE Linux Enterprise

Update to version 4.8.4.

phpMyAdmin - update to 4.8.4
phpmyadmin (Alpine package) - addressed in versions 4.8.4-r0, 4.8.5-r0
phpmyadmin (Ubuntu package) - update to 4:4.6.6-5ubuntu0.5

• https://www.phpmyadmin.net/security/PMASA-2018-6/

• Multiple vulnerabilities in phpMyAdmin
• OpenSUSE Linux update for phpMyAdmin
• OpenSUSE Linux update for phpMyAdmin
• Gentoo update for phpMyAdmin
• Memory leak in phpmyadmin (Alpine package)
• Ubuntu update for phpmyadmin