USN-4693-1: Ampache vulnerabilities

Releases

• Ubuntu 16.04 ESM

Packages

• ampache - web-based audio file management system

Details

It was discovered that an SQL injection vulnerability exists in the Ampache
search engine. Any user able to perform searches could dump any data contained
in the database. An attacker could use this to disclose sensitive information.
(CVE-2019-12385)

It was discovered that an XSS vulnerability in Ampache. An attacker could use
this vulnerability to force an admin to create a new privileged user.
(CVE-2019-12386)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04

• ampache - 3.6-rzb2779+dfsg-0ubuntu9.2
• ampache-common - 3.6-rzb2779+dfsg-0ubuntu9.2

After a standard system update you need to restart ampache to make
all the necessary changes.

References

• CVE-2019-12386
• CVE-2019-12385