CVE-2016-9854

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-9854
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9854.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-9854
Downstream
Related
Published
2016-12-11T02:59:52.850Z
Modified
2026-07-08T12:53:35.346045Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the json_decode issue.

References

Affected packages

Git / github.com/phpmyadmin/phpmyadmin

Affected ranges

Type
GIT
Repo
https://github.com/phpmyadmin/phpmyadmin
Events
Introduced
1fe735d098d82ad79500eab04c4d25ba8fe25a24
Last affected
b9a6a9993e175ff13375462333ce1139095d01e1
Database specific 
{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "4.4.0"
        },
        {
            "last_affected": "4.4.0"
        },
        {
            "introduced": "4.4.1"
        },
        {
            "last_affected": "4.4.1"
        },
        {
            "introduced": "4.4.1.1"
        },
        {
            "last_affected": "4.4.1.1"
        },
        {
            "introduced": "4.4.2"
        },
        {
            "last_affected": "4.4.2"
        },
        {
            "introduced": "4.4.3"
        },
        {
            "last_affected": "4.4.3"
        },
        {
            "introduced": "4.4.4"
        },
        {
            "last_affected": "4.4.4"
        },
        {
            "introduced": "4.4.5"
        },
        {
            "last_affected": "4.4.5"
        },
        {
            "introduced": "4.4.6"
        },
        {
            "last_affected": "4.4.6"
        },
        {
            "introduced": "4.4.6.1"
        },
        {
            "last_affected": "4.4.6.1"
        },
        {
            "introduced": "4.4.7"
        },
        {
            "last_affected": "4.4.7"
        },
        {
            "introduced": "4.4.8"
        },
        {
            "last_affected": "4.4.8"
        },
        {
            "introduced": "4.4.9"
        },
        {
            "last_affected": "4.4.9"
        },
        {
            "introduced": "4.4.10"
        },
        {
            "last_affected": "4.4.10"
        },
        {
            "introduced": "4.4.11"
        },
        {
            "last_affected": "4.4.11"
        },
        {
            "introduced": "4.4.12"
        },
        {
            "last_affected": "4.4.12"
        },
        {
            "introduced": "4.4.13"
        },
        {
            "last_affected": "4.4.13"
        },
        {
            "introduced": "4.4.13.1"
        },
        {
            "last_affected": "4.4.13.1"
        },
        {
            "introduced": "4.4.14"
        },
        {
            "last_affected": "4.4.14"
        },
        {
            "introduced": "4.4.14.1"
        },
        {
            "last_affected": "4.4.14.1"
        },
        {
            "introduced": "4.4.15"
        },
        {
            "last_affected": "4.4.15"
        },
        {
            "introduced": "4.4.15.1"
        },
        {
            "last_affected": "4.4.15.1"
        },
        {
            "introduced": "4.4.15.2"
        },
        {
            "last_affected": "4.4.15.2"
        },
        {
            "introduced": "4.4.15.3"
        },
        {
            "last_affected": "4.4.15.3"
        },
        {
            "introduced": "4.4.15.4"
        },
        {
            "last_affected": "4.4.15.4"
        },
        {
            "introduced": "4.4.15.5"
        },
        {
            "last_affected": "4.4.15.5"
        },
        {
            "introduced": "4.4.15.6"
        },
        {
            "last_affected": "4.4.15.6"
        },
        {
            "introduced": "4.4.15.7"
        },
        {
            "last_affected": "4.4.15.7"
        },
        {
            "introduced": "4.4.15.8"
        },
        {
            "last_affected": "4.4.15.8"
        },
        {
            "introduced": "4.6.0"
        },
        {
            "last_affected": "4.6.0"
        },
        {
            "introduced": "4.6.1"
        },
        {
            "last_affected": "4.6.1"
        },
        {
            "introduced": "4.6.2"
        },
        {
            "last_affected": "4.6.2"
        },
        {
            "introduced": "4.6.3"
        },
        {
            "last_affected": "4.6.3"
        },
        {
            "introduced": "4.6.4"
        },
        {
            "last_affected": "4.6.4"
        }
    ]
}

Affected versions

4.*
4.4.0
4.4.1
4.4.1.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.13.1
4.4.14
4.4.14.1
4.4.15
4.4.15.1
4.4.15.2
4.4.15.3
4.4.15.4
4.4.15.5
4.4.15.6
4.4.15.7
4.4.15.8
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.6.1
4.4.7
4.4.8
4.4.9
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9854.json"