Vulnerabilities > CVE-2015-4792

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802.

Vulnerable Configurations

Part	Description	Count
OS	Opensuse Opensuse Leap 42.1 Opensuse Opensuse 13.1 Opensuse Opensuse 13.2	3
OS	Redhat Redhat Enterprise Linux Desktop 7.0 Redhat Enterprise Linux Server AUS 7.2 Redhat Enterprise Linux Server AUS 7.3 Redhat Enterprise Linux Server AUS 7.4 Redhat Enterprise Linux Server AUS 7.6 Redhat Enterprise Linux Server AUS 7.7 Redhat Enterprise Linux Workstation 7.0 Redhat Enterprise Linux Server TUS 7.2 Redhat Enterprise Linux Server TUS 7.3 Redhat Enterprise Linux Server TUS 7.6 Redhat Enterprise Linux Server TUS 7.7 Redhat Enterprise Linux Server 7.0 Redhat Enterprise Linux EUS 7.3 Redhat Enterprise Linux EUS 7.4 Redhat Enterprise Linux EUS 7.5 Redhat Enterprise Linux EUS 7.6 Redhat Enterprise Linux EUS 7.2 Redhat Enterprise Linux EUS 7.7	18
OS	Oracle Oracle Solaris 11.3 Oracle Linux 7	2
OS	Debian Debian Debian Linux 8.0 Debian Debian Linux 7.0	2
OS	Fedoraproject Fedoraproject Fedora 23	1
OS	Canonical Canonical Ubuntu Linux 15.10 Canonical Ubuntu Linux 15.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 12.04	4
Application	Oracle Oracle Mysql 5.5.0 Oracle Mysql 5.5.1 Oracle Mysql 5.5.2 Oracle Mysql 5.5.3 Oracle Mysql 5.5.4 Oracle Mysql 5.5.5 Oracle Mysql 5.5.6 Oracle Mysql 5.5.7 Oracle Mysql 5.5.8 Oracle Mysql 5.5.9 Oracle Mysql 5.5.10 Oracle Mysql 5.5.11 Oracle Mysql 5.5.12 Oracle Mysql 5.5.13 Oracle Mysql 5.5.14 Oracle Mysql 5.5.15 Oracle Mysql 5.5.16 Oracle Mysql 5.5.17 Oracle Mysql 5.5.18 Oracle Mysql 5.5.19 Oracle Mysql 5.5.20 Oracle Mysql 5.5.21 Oracle Mysql 5.5.22 Oracle Mysql 5.5.23 Oracle Mysql 5.5.24 Oracle Mysql 5.5.25 Oracle Mysql 5.5.26 Oracle Mysql 5.5.27 Oracle Mysql 5.5.28 Oracle Mysql 5.5.29 Oracle Mysql 5.5.30 Oracle Mysql 5.5.31 Oracle Mysql 5.5.32 Oracle Mysql 5.5.33 Oracle Mysql 5.5.34 Oracle Mysql 5.5.35 Oracle Mysql 5.5.36 Oracle Mysql 5.5.37 Oracle Mysql 5.5.38 Oracle Mysql 5.5.39 Oracle Mysql 5.5.40 Oracle Mysql 5.5.41 Oracle Mysql 5.5.42 Oracle Mysql 5.5.43 Oracle Mysql 5.5.44 Oracle Mysql 5.5.45 Oracle Mysql 5.6.0 Oracle Mysql 5.6.1 Oracle Mysql 5.6.2 Oracle Mysql 5.6.3 Oracle Mysql 5.6.4 Oracle Mysql 5.6.5 Oracle Mysql 5.6.6 Oracle Mysql 5.6.7 Oracle Mysql 5.6.8 Oracle Mysql 5.6.9 Oracle Mysql 5.6.10 Oracle Mysql 5.6.11 Oracle Mysql 5.6.12 Oracle Mysql 5.6.13 Oracle Mysql 5.6.14 Oracle Mysql 5.6.15 Oracle Mysql 5.6.16 Oracle Mysql 5.6.17 Oracle Mysql 5.6.18 Oracle Mysql 5.6.19 Oracle Mysql 5.6.20 Oracle Mysql 5.6.21 Oracle Mysql 5.6.22 Oracle Mysql 5.6.23 Oracle Mysql 5.6.24 Oracle Mysql 5.6.25 Oracle Mysql 5.6.26	75
Application	Mariadb Mariadb Mariadb 10.1.0 Mariadb Mariadb 10.1.1 Mariadb Mariadb 10.1.2 Mariadb Mariadb 10.1.3 Mariadb Mariadb 10.1.4 Mariadb Mariadb 10.1.5 Mariadb Mariadb 10.1.6 Mariadb Mariadb 10.1.7 Mariadb Mariadb 10.0.0 Mariadb Mariadb 10.0.1 Mariadb Mariadb 10.0.2 Mariadb Mariadb 10.0.3 Mariadb Mariadb 10.0.4 Mariadb Mariadb 10.0.5 Mariadb Mariadb 10.0.6 Mariadb Mariadb 10.0.7 Mariadb Mariadb 10.0.8 Mariadb Mariadb 10.0.9 Mariadb Mariadb 10.0.10 Mariadb Mariadb 10.0.11 Mariadb Mariadb 10.0.12 Mariadb Mariadb 10.0.13 Mariadb Mariadb 10.0.14 Mariadb Mariadb 10.0.15 Mariadb Mariadb 10.0.16 Mariadb Mariadb 10.0.17 Mariadb Mariadb 10.0.18 Mariadb Mariadb 10.0.19 Mariadb Mariadb 10.0.20 Mariadb Mariadb 10.0.21 Mariadb Mariadb 5.5.0 Mariadb Mariadb 5.5.20 Mariadb Mariadb 5.5.21 Mariadb Mariadb 5.5.22 Mariadb Mariadb 5.5.23 Mariadb Mariadb 5.5.24 Mariadb Mariadb 5.5.25 Mariadb Mariadb 5.5.27 Mariadb Mariadb 5.5.28 Mariadb Mariadb 5.5.28A Mariadb Mariadb 5.5.33 Mariadb Mariadb 5.5.34 Mariadb Mariadb 5.5.35 Mariadb Mariadb 5.5.40 Mariadb Mariadb 5.5.43	46

Nessus

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2015-890.NASL
description	MariaDB was updated to 5.5.46 to fix security issues and bugs. The following vulnerabilities were fixed in the upstream release : CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 A list of upstream changes and release notes can be found here: https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-5546-changelog/
last seen	2020-06-05
modified	2015-12-18
plugin id	87486
published	2015-12-18
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/87486
title	openSUSE Security Update : MariaDB 5.5.46 (openSUSE-2015-890)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2015-890. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(87486); script_version("2.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2015-4792", "CVE-2015-4802", "CVE-2015-4807", "CVE-2015-4815", "CVE-2015-4826", "CVE-2015-4830", "CVE-2015-4836", "CVE-2015-4858", "CVE-2015-4861", "CVE-2015-4870", "CVE-2015-4913"); script_name(english:"openSUSE Security Update : MariaDB 5.5.46 (openSUSE-2015-890)"); script_summary(english:"Check for the openSUSE-2015-890 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "MariaDB was updated to 5.5.46 to fix security issues and bugs. The following vulnerabilities were fixed in the upstream release : CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 A list of upstream changes and release notes can be found here: https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-5546-changelog/" ); # https://mariadb.com/kb/en/mariadb/mariadb-5546-changelog/ script_set_attribute( attribute:"see_also", value:"https://mariadb.com/kb/en/library/mariadb-5546-changelog/" ); # https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/ script_set_attribute( attribute:"see_also", value:"https://mariadb.com/kb/en/library/mariadb-5546-release-notes/" ); script_set_attribute( attribute:"solution", value:"Update the affected MariaDB 5.5.46 packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r18"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r18-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld18"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld18-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-bench"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-bench-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-client-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-errormessages"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-test-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-tools-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1"); script_set_attribute(attribute:"vuln_publication_date", value:"2015/10/21"); script_set_attribute(attribute:"patch_publication_date", value:"2015/12/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/18"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE13\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE13.1", reference:"libmysqlclient-devel-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libmysqlclient18-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libmysqlclient18-debuginfo-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libmysqlclient_r18-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libmysqld-devel-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libmysqld18-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libmysqld18-debuginfo-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-bench-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-bench-debuginfo-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-client-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-client-debuginfo-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-debuginfo-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-debugsource-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-errormessages-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-test-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-test-debuginfo-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-tools-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"mariadb-tools-debuginfo-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libmysqlclient18-32bit-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libmysqlclient18-debuginfo-32bit-5.5.46-13.1") ) flag++; if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libmysqlclient_r18-32bit-5.5.46-13.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libmysqlclient-devel / libmysqlclient18-32bit / libmysqlclient18 / etc"); }

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-65A1F22818.NASL
description	This is an update to 5.6.29 that delivers also all fixes for CVE-2015-4766, CVE-2015-4791, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-03-10
plugin id	89800
published	2016-03-10
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/89800
title	Fedora 23 : community-mysql-5.6.29-1.fc23 (2016-65a1f22818)

NASL family	Databases
NASL id	MYSQL_5_5_46.NASL
description	The version of MySQL running on the remote host is 5.5.x prior to 5.5.46. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Client Programs subcomponent. A local attacker can exploit this to gain elevated privileges. (CVE-2015-4819) - An unspecified flaw exists in the Types subcomponent. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaws exist in the Security:Privileges subcomponent. An authenticated, remote attacker can exploit these to impact integrity. (CVE-2015-4830, CVE-2015-4864) - An unspecified flaw exists in the DLM subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2015-4879) - An unspecified flaw exists in the Server Security Encryption subcomponent that allows an authenticated, remote attacker to disclose sensitive information. (CVE-2015-7744) Additionally, unspecified denial of service vulnerabilities can also exist in the following MySQL subcomponents : - DDL (CVE-2015-4815) - DML (CVE-2015-4858, CVE-2015-4913) - InnoDB (CVE-2015-4816, CVE-2015-4861) - Parser (CVE-2015-4870) - Partition (CVE-2015-4792, CVE-2015-4802) - Query (CVE-2015-4807) - SP (CVE-2015-4836)
last seen	2020-06-01
modified	2020-06-02
plugin id	86546
published	2015-10-22
reporter	This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86546
title	MySQL 5.5.x < 5.5.46 Multiple Vulnerabilities

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2016-0534.NASL
description	An update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix(es) : * It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
last seen	2020-06-01
modified	2020-06-02
plugin id	90276
published	2016-04-01
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/90276
title	CentOS 7 : mariadb (CESA-2016:0534)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2016-1011.NASL
description	According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) - This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.(CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2017-05-01
plugin id	99774
published	2017-05-01
reporter	This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99774
title	EulerOS 2.0 SP1 : mariadb (EulerOS-SA-2016-1011)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-868C170507.NASL
description	This is an update to 10.0.23 that delivers also all fixes for CVE-2015-4792, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-03-07
plugin id	89701
published	2016-03-07
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/89701
title	Fedora 22 : mariadb-10.0.23-1.fc22 (2016-868c170507)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2015-889.NASL
description	MySQL was updated to 5.6.27 to fix security issues and bugs. The following vulnerabilities were fixed as part of the upstream release [boo#951391]: CVE-2015-1793, CVE-2015-0286, CVE-2015-0288, CVE-2015-1789, CVE-2015-4730, CVE-2015-4766, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913 Details on these and other changes can be found at: http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-27.html The following security relevant changes are included additionally : - CVE-2015-3152: MySQL lacked SSL enforcement. Using --ssl-verify-server-cert and --ssl[-*] implies that the ssl connection is required. The mysql client will now print an error if ssl is required, but the server can not handle a ssl connection [boo#924663], [boo#928962]
last seen	2020-06-05
modified	2015-12-17
plugin id	87442
published	2015-12-17
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/87442
title	openSUSE Security Update : mysql (openSUSE-2015-889) (BACKRONYM)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3385.NASL
description	Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.22. Please see the MariaDB 10.0 Release Notes for further details : - https://mariadb.com/kb/en/mariadb/mariadb-10021-release- notes/ - https://mariadb.com/kb/en/mariadb/mariadb-10022-release- notes/
last seen	2020-06-01
modified	2020-06-02
plugin id	86679
published	2015-11-02
reporter	This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86679
title	Debian DSA-3385-1 : mariadb-10.0 - security update

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2016-684.NASL
description	wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, also known as a Lenstra attack. (CVE-2015-7744) Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. (CVE-2015-4864) Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4866) Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4861) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2015-4862) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0616) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached. (CVE-2015-4910) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858 . (CVE-2015-4913) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0610) Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0594) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0595) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0596) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0597) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0598) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802 . (CVE-2015-4792) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges. (CVE-2015-4791) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via unknown vectors related to Server : Query Cache. (CVE-2015-4807) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser. (CVE-2015-4870) Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0599) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. (CVE-2016-0546) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913 . (CVE-2015-4858) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL. (CVE-2015-4815) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition. (CVE-2015-4833) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. (CVE-2015-4830) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP. (CVE-2015-4836) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to UDF. (CVE-2016-0608) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to privileges. (CVE-2016-0609) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Options. (CVE-2016-0505) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503 . (CVE-2016-0504) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication. (CVE-2015-4890) Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Partition. (CVE-2016-0601) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to libmysqld. (CVE-2015-4904) Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML. (CVE-2015-4905) Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors. (CVE-2016-0605) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect integrity via unknown vectors related to encryption. (CVE-2016-0606) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect availability via unknown vectors related to Server : Security : Firewall. (CVE-2015-4766) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0611) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to replication. (CVE-2016-0607) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs. (CVE-2015-4819) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML. (CVE-2015-4879) Unspecified vulnerability in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0502) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4895) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504 . (CVE-2016-0503) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0600) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792 . (CVE-2015-4802) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. (CVE-2015-4800) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types. (CVE-2015-4826)
last seen	2020-06-01
modified	2020-06-02
plugin id	90366
published	2016-04-07
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/90366
title	Amazon Linux AMI : mysql56 (ALAS-2016-684)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20160404_MARIADB_ON_SL7_X.NASL
description	Security Fix(es) : - It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : - When more than one INSERT operation was executed concurrently on a non- empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
last seen	2020-03-18
modified	2016-04-05
plugin id	90345
published	2016-04-05
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/90345
title	Scientific Linux Security Update : mariadb on SL7.x x86_64 (20160404)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-0121-1.NASL
description	MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed : - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 - 10.0.21: CVE-2015-4816, CVE-2015-4819, CVE-2015-4879, CVE-2015-4895 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	87964
published	2016-01-18
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/87964
title	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0121-1)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-164.NASL
description	MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed : - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 - Fix information leak via mysql-systemd-helper script. (CVE-2015-5969, bsc#957174) For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents : - https://kb.askmonty.org/en/mariadb-10022-release-notes/ - https://kb.askmonty.org/en/mariadb-10022-changelog/ This update was imported from the SUSE:SLE-12-SP1:Update update project.
last seen	2020-06-05
modified	2016-02-08
plugin id	88615
published	2016-02-08
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/88615
title	openSUSE Security Update : mariadb (openSUSE-2016-164)

NASL family	Databases
NASL id	MYSQL_5_6_27_RPM.NASL
description	The version of Oracle MySQL installed on the remote host is 5.6.x prior to 5.6.27. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Types subcomponent. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaw exists in the Security:Privileges subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2015-4830) - An unspecified flaw exists in the Security:Encryption subcomponent. An unauthenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-7744) - An unspecified flaw exists in the Options subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3471) Additionally, unspecified denial of service vulnerabilities exist in the following MySQL subcomponents : - DDL (CVE-2015-4815) - DML (CVE-2015-4858, CVE-2015-4862, CVE-2015-4913) - General (CVE-2016-0605) - InnoDB (CVE-2015-4861) - Memcached (CVE-2015-4910) - Optimizer (CVE-2015-4800) - Parser (CVE-2015-4870) - Partition (CVE-2015-4792, CVE-2015-4802) - Replication (CVE-2015-4890) - Security:Privileges (CVE-2015-4791) - SP (CVE-2015-4836)
last seen	2020-06-04
modified	2015-10-29
plugin id	86661
published	2015-10-29
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86661
title	Oracle MySQL 5.6.x < 5.6.27 Multiple Vulnerabilities (October 2015 CPU) (January 2016 CPU) (July 2016 CPU)

NASL family	Databases
NASL id	MYSQL_5_5_46_RPM.NASL
description	The version of Oracle MySQL installed on the remote host is 5.5.x prior to 5.5.46. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Types subcomponent. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaw exists in the Security:Privileges subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2015-4830) - An unspecified flaw exists in the Security:Encryption subcomponent. An unauthenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-7744) - An unspecified flaw exists in the Options subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3471) Additionally, unspecified denial of service vulnerabilities exist in the following MySQL subcomponents : - DDL (CVE-2015-4815) - DML (CVE-2015-4858, CVE-2015-4913) - InnoDB (CVE-2015-4861) - Parser (CVE-2015-4870) - Partition (CVE-2015-4792, CVE-2015-4802) - SP (CVE-2015-4836)
last seen	2020-06-04
modified	2015-10-29
plugin id	86658
published	2015-10-29
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86658
title	Oracle MySQL 5.5.x < 5.5.46 Multiple Vulnerabilities (October 2015 CPU) (January 2016 CPU) (July 2016 CPU)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_851A0EEA88AA11E590E7B499BAEBFEAF.NASL
description	Oracle reports : Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior
last seen	2020-06-01
modified	2020-06-02
plugin id	86858
published	2015-11-12
reporter	This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86858
title	FreeBSD : MySQL - Multiple vulnerabilities (851a0eea-88aa-11e5-90e7-b499baebfeaf)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2015-2303-1.NASL
description	The mysql package was updated to version 5.5.46 to fixs several security and non security issues. - bnc#951391: update to version 5.5.46 - changes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5- 46.html - fixed CVEs: CVE-2015-1793, CVE-2015-0286, CVE-2015-0288, CVE-2015-1789, CVE-2015-4730, CVE-2015-4766, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913 - bnc#952196: Fixed a build error for ppc, s390 and ia64 architectures. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	87525
published	2015-12-21
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/87525
title	SUSE SLED11 / SLES11 Security Update : mysql (SUSE-SU-2015:2303-1)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2016-0534.NASL
description	From Red Hat Security Advisory 2016:0534 : An update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix(es) : * It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
last seen	2020-06-01
modified	2020-06-02
plugin id	90296
published	2016-04-01
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/90296
title	Oracle Linux 7 : mariadb (ELSA-2016-0534)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-2781-1.NASL
description	Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.5.46 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 15.04 and Ubuntu 15.10 have been updated to MySQL 5.6.27. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-45.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-26.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-27.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.h tml. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	86617
published	2015-10-27
reporter	Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86617
title	Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : mysql-5.5, mysql-5.6 vulnerabilities (USN-2781-1)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3377.NASL
description	Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.46. Please see the MySQL 5.5 Release Notes and Oracle
last seen	2020-06-01
modified	2020-06-02
plugin id	86580
published	2015-10-26
reporter	This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86580
title	Debian DSA-3377-1 : mysql-5.5 - security update

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2015-884.NASL
description	MariaDB was updated to 10.0.22 to fix security issues and bugs. The following vulnerabilities were fixed in the upstream release : CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 A list of upstream changes and release notes can be found here : - https://kb.askmonty.org/en/mariadb-10022-release-notes/ - https://kb.askmonty.org/en/mariadb-10022-changelog/ The following build problems were fixed : - bsc#937787: fix main.bootstrap test (change default charset to utf8 in test result)
last seen	2020-06-05
modified	2015-12-17
plugin id	87440
published	2015-12-17
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/87440
title	openSUSE Security Update : mariadb (openSUSE-2015-884)

NASL family	Databases
NASL id	MYSQL_5_6_27.NASL
description	The version of MySQL running on the remote host is 5.6.x prior to 5.6.27. It is, therefore, potentially affected by the following vulnerabilities : - A certificate validation bypass vulnerability exists in the Security:Encryption subcomponent due to a flaw in the X509_verify_cert() function in x509_vfy.c that is triggered when locating alternate certificate chains when the first attempt to build such a chain fails. A remote attacker can exploit this, by using a valid leaf certificate as a certificate authority (CA), to issue invalid certificates that will bypass authentication. (CVE-2015-1793) - An unspecified flaw exists in the Client Programs subcomponent. A local attacker can exploit this to gain elevated privileges. (CVE-2015-4819) - An unspecified flaw exists in the Types subcomponent. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaws exist in the Security:Privileges subcomponent. An authenticated, remote attacker can exploit these to impact integrity. (CVE-2015-4830, CVE-2015-4864) - An unspecified flaw exists in the DLM subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2015-4879) - An unspecified flaw exists in the Server Security Encryption subcomponent that allows an authenticated, remote attacker to disclose sensitive information. (CVE-2015-7744) Additionally, unspecified denial of service vulnerabilities can also exist in the following MySQL subcomponents : - DDL (CVE-2015-4815) - DML (CVE-2015-4858, CVE-2015-4862, CVE-2015-4905, CVE-2015-4913) - InnoDB (CVE-2015-4861, CVE-2015-4866, CVE-2015-4895) - libmysqld (CVE-2015-4904) - Memcached (CVE-2015-4910) - Optimizer (CVE-2015-4800) - Parser (CVE-2015-4870) - Partition (CVE-2015-4792, CVE-2015-4802, CVE-2015-4833) - Query (CVE-2015-4807) - Replication (CVE-2015-4890) - Security : Firewall (CVE-2015-4766) - Server : General (CVE-2016-0605) - Security : Privileges (CVE-2015-4791) - SP (CVE-2015-4836) - Types (CVE-2015-4730)
last seen	2020-06-01
modified	2020-06-02
plugin id	86547
published	2015-10-22
reporter	This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86547
title	MySQL 5.6.x < 5.6.27 Multiple Vulnerabilities

NASL family	Databases
NASL id	MARIADB_5_5_46.NASL
description	The version of MariaDB running on the remote host is prior to 5.5.46. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified flaws exist related to the Partition subcomponent that allow an authenticated, remote attacker to cause a denial of service. (CVE-2015-4802, CVE-2015-4792) - An unspecified flaw exists related to the Query Cache subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4807) - An unspecified flaw exists related to the DDL subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4815) - An unspecified flaw exists related to the Types subcomponent that allows an authenticated, remote attacker to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaw exists related to the Security:Privileges subcomponent that allows an authenticated, remote attacker to affect the integrity of the system. No other details are available. (CVE-2015-4830) - An unspecified flaw exists related to the SP subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4836) - Multiple unspecified flaws exist related to the DML subcomponent that allow an authenticated, remote attacker to cause a denial of service. (CVE-2015-4858, CVE-2015-4913) - An unspecified flaw exists related to the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4861) - An unspecified flaw exists related to the Parser subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4870) - A flaw exists in the mysql_prepare_create_table() function due to improper handling of a comma buffer that is greater than zero. An authenticated, remote attacker can exploit this to cause a denial of service condition.
last seen	2020-06-01
modified	2020-06-02
plugin id	87210
published	2015-12-04
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/87210
title	MariaDB < 5.5.46 Multiple Vulnerabilities

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-E30164D0A2.NASL
description	This is an update to 10.0.23 that delivers also all fixes for CVE-2015-4792, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-03-04
plugin id	89628
published	2016-03-04
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/89628
title	Fedora 23 : mariadb-10.0.23-1.fc23 (2016-e30164d0a2)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2016-0534.NASL
description	An update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix(es) : * It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
last seen	2020-06-01
modified	2020-06-02
plugin id	90300
published	2016-04-01
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/90300
title	RHEL 7 : mariadb (RHSA-2016:0534)

NASL family	Databases
NASL id	MARIADB_10_0_22.NASL
description	The version of MariaDB running on the remote host is 10.0.x prior to 10.0.22. It is, therefore, affected by multiple vulnerabilities : - Multiple denial of service vulnerabilities exist due to multiple unspecified flaws in the
last seen	2020-06-01
modified	2020-06-02
plugin id	86874
published	2015-11-13
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86874
title	MariaDB 10.0.x < 10.0.22 Multiple Vulnerabilities

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-5CB344DD7E.NASL
description	This is an update to 5.6.29 that delivers also all fixes for CVE-2015-4766, CVE-2015-4791, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-03-10
plugin id	89799
published	2016-03-10
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/89799
title	Fedora 22 : community-mysql-5.6.29-1.fc22 (2016-5cb344dd7e)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-0296-1.NASL
description	MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed : - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 - Fix information leak via mysql-systemd-helper script. (CVE-2015-5969, bsc#957174) For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents : - https://kb.askmonty.org/en/mariadb-10022-release-notes/ - https://kb.askmonty.org/en/mariadb-10022-changelog/ Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	88515
published	2016-02-02
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/88515
title	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0296-1)

Redhat

advisories

rhsa
id RHSA-2016:0534
rhsa
id RHSA-2016:0705
rhsa
id RHSA-2016:1132
rhsa
id RHSA-2016:1480
rhsa
id RHSA-2016:1481

rpms

mariadb-1:5.5.47-1.el7_2
mariadb-bench-1:5.5.47-1.el7_2
mariadb-debuginfo-1:5.5.47-1.el7_2
mariadb-devel-1:5.5.47-1.el7_2
mariadb-embedded-1:5.5.47-1.el7_2
mariadb-embedded-devel-1:5.5.47-1.el7_2
mariadb-libs-1:5.5.47-1.el7_2
mariadb-server-1:5.5.47-1.el7_2
mariadb-test-1:5.5.47-1.el7_2
rh-mysql56-mysql-0:5.6.30-1.el6
rh-mysql56-mysql-0:5.6.30-1.el7
rh-mysql56-mysql-bench-0:5.6.30-1.el6
rh-mysql56-mysql-bench-0:5.6.30-1.el7
rh-mysql56-mysql-common-0:5.6.30-1.el6
rh-mysql56-mysql-common-0:5.6.30-1.el7
rh-mysql56-mysql-config-0:5.6.30-1.el6
rh-mysql56-mysql-config-0:5.6.30-1.el7
rh-mysql56-mysql-debuginfo-0:5.6.30-1.el6
rh-mysql56-mysql-debuginfo-0:5.6.30-1.el7
rh-mysql56-mysql-devel-0:5.6.30-1.el6
rh-mysql56-mysql-devel-0:5.6.30-1.el7
rh-mysql56-mysql-errmsg-0:5.6.30-1.el6
rh-mysql56-mysql-errmsg-0:5.6.30-1.el7
rh-mysql56-mysql-server-0:5.6.30-1.el6
rh-mysql56-mysql-server-0:5.6.30-1.el7
rh-mysql56-mysql-test-0:5.6.30-1.el6
rh-mysql56-mysql-test-0:5.6.30-1.el7
rh-mariadb100-mariadb-1:10.0.25-4.el6
rh-mariadb100-mariadb-1:10.0.25-4.el7
rh-mariadb100-mariadb-bench-1:10.0.25-4.el6
rh-mariadb100-mariadb-bench-1:10.0.25-4.el7
rh-mariadb100-mariadb-common-1:10.0.25-4.el6
rh-mariadb100-mariadb-common-1:10.0.25-4.el7
rh-mariadb100-mariadb-config-1:10.0.25-4.el6
rh-mariadb100-mariadb-config-1:10.0.25-4.el7
rh-mariadb100-mariadb-debuginfo-1:10.0.25-4.el6
rh-mariadb100-mariadb-debuginfo-1:10.0.25-4.el7
rh-mariadb100-mariadb-devel-1:10.0.25-4.el6
rh-mariadb100-mariadb-devel-1:10.0.25-4.el7
rh-mariadb100-mariadb-errmsg-1:10.0.25-4.el6
rh-mariadb100-mariadb-errmsg-1:10.0.25-4.el7
rh-mariadb100-mariadb-oqgraph-engine-1:10.0.25-4.el6
rh-mariadb100-mariadb-oqgraph-engine-1:10.0.25-4.el7
rh-mariadb100-mariadb-server-1:10.0.25-4.el6
rh-mariadb100-mariadb-server-1:10.0.25-4.el7
rh-mariadb100-mariadb-test-1:10.0.25-4.el6
rh-mariadb100-mariadb-test-1:10.0.25-4.el7
mysql55-mysql-0:5.5.50-1.el6
mysql55-mysql-0:5.5.50-1.el7
mysql55-mysql-bench-0:5.5.50-1.el6
mysql55-mysql-bench-0:5.5.50-1.el7
mysql55-mysql-debuginfo-0:5.5.50-1.el6
mysql55-mysql-debuginfo-0:5.5.50-1.el7
mysql55-mysql-devel-0:5.5.50-1.el6
mysql55-mysql-devel-0:5.5.50-1.el7
mysql55-mysql-libs-0:5.5.50-1.el6
mysql55-mysql-libs-0:5.5.50-1.el7
mysql55-mysql-server-0:5.5.50-1.el6
mysql55-mysql-server-0:5.5.50-1.el7
mysql55-mysql-test-0:5.5.50-1.el6
mysql55-mysql-test-0:5.5.50-1.el7
mariadb55-mariadb-0:5.5.49-1.el6
mariadb55-mariadb-0:5.5.49-1.el7
mariadb55-mariadb-bench-0:5.5.49-1.el6
mariadb55-mariadb-bench-0:5.5.49-1.el7
mariadb55-mariadb-debuginfo-0:5.5.49-1.el6
mariadb55-mariadb-debuginfo-0:5.5.49-1.el7
mariadb55-mariadb-devel-0:5.5.49-1.el6
mariadb55-mariadb-devel-0:5.5.49-1.el7
mariadb55-mariadb-libs-0:5.5.49-1.el6
mariadb55-mariadb-libs-0:5.5.49-1.el7
mariadb55-mariadb-server-0:5.5.49-1.el6
mariadb55-mariadb-server-0:5.5.49-1.el7
mariadb55-mariadb-test-0:5.5.49-1.el6
mariadb55-mariadb-test-0:5.5.49-1.el7

Vulnerabilities > CVE-2015-4792 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2015-4792"}]}

Summary

Vulnerable Configurations

Nessus

Redhat

References

Vulnerabilities > CVE-2015-4792