CVE-2016-9847

An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user's blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

• CWE-310

• http://www.securityfocus.com/bid/94524Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-58Patch, Vendor Advisory
• http://www.securityfocus.com/bid/94524Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-58Patch, Vendor Advisory

Published

Dec 11, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9841inffast.c in zlib 1.2.8 might allow context-dependent attack…9.8
• CVE-2016-9842The inflateMark function in inflate.c in zlib 1.2.8 might al…8.8
• CVE-2016-9843The crc32_big function in crc32.c in zlib 1.2.8 might allow …9.8
• CVE-2016-9844Buffer overflow in the zi_short function in zipinfo.c in Inf…
• CVE-2016-9845QEMU (aka Quick Emulator) built with the Virtio GPU Device e…6.5
• CVE-2016-9846QEMU (aka Quick Emulator) built with the Virtio GPU Device e…6.5
• CVE-2016-9848An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php)…
• CVE-2016-9849An issue was discovered in phpMyAdmin. It is possible to byp…
• CVE-2016-9850An issue was discovered in phpMyAdmin. Username matching for…
• CVE-2016-9851An issue was discovered in phpMyAdmin. With a crafted reques…
• CVE-2016-9852An issue was discovered in phpMyAdmin. By calling some scrip…
• CVE-2016-9853An issue was discovered in phpMyAdmin. By calling some scrip…