CVE-2016-7405
The qstr method in the PDO driver in the ADOdb Library for PHP before ...
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Ubuntu (orta).
Açıklama
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| composer::GitHub Security Advisory Composer | adodb/adodb-php | 5.20.7 |
| debian 11 | libphp-adodb | 5.20.6-1 |
| debian 12 | libphp-adodb | 5.20.6-1 |
| debian 13 | libphp-adodb | 5.20.6-1 |
| debian 14 | libphp-adodb | 5.20.6-1 |
| debian 7 | libphp-adodb | 5.15-1+deb7u1 |
| debian 8 | libphp-adodb | 5.15-1+deb8u1 |
| echo | libphp-adodb | 5.20.6-1 |
| ubuntu 16.04-ESM | libphp-adodb | 5.20.3-1ubuntu1+esm1 |
Referanslar
- http://www.openwall.com/lists/oss-security/2016/09/07/8
- http://www.openwall.com/lists/oss-security/2016/09/15/1
- http://www.securityfocus.com/bid/92969
- https://github.com/ADOdb/ADOdb/blob/v5.20.7/docs/changelog.md
- https://github.com/ADOdb/ADOdb/commit/bd9eca9
- https://github.com/ADOdb/ADOdb/commit/bd9eca9f40220f9918ec3cc7ae9ef422b3e448b8
- https://github.com/ADOdb/ADOdb/issues/226
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LT3WU77BRUJREZUYQ3ZQBMUIVIVIND4Y
14 referansın hepsi
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LT3WU77BRUJREZUYQ3ZQBMUIVIVIND4Y/
- https://nvd.nist.gov/vuln/detail/CVE-2016-7405
- https://security.gentoo.org/glsa/201701-59
- https://ubuntu.com/security/notices/USN-6825-1
- https://web.archive.org/web/20210123170727/http://www.securityfocus.com/bid/92969
- https://www.cve.org/CVERecord?id=CVE-2016-7405