Vulnerabilities > CVE-2015-4870

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
oracle
opensuse
mariadb
canonical
debian
redhat
fedoraproject
nessus
exploit available

Summary

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.

Vulnerable Configurations

Part Description Count
OS
Oracle
2
OS
Opensuse
3
OS
Canonical
4
OS
Debian
2
OS
Redhat
17
OS
Fedoraproject
1
Application
Oracle
75
Application
Mariadb
46

Exploit-Db

descriptionMySQL 5.5.45 - procedure analyse Function Denial of Service. CVE-2015-4870. Dos exploits for multiple platform
fileexploits/multiple/dos/39867.py
idEDB-ID:39867
last seen2016-05-30
modified2016-05-30
platformmultiple
port
published2016-05-30
reporterOsanda Malith
sourcehttps://www.exploit-db.com/download/39867/
titleMySQL 5.5.45 - procedure analyse Function Denial of Service
typedos

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-890.NASL
    descriptionMariaDB was updated to 5.5.46 to fix security issues and bugs. The following vulnerabilities were fixed in the upstream release : CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 A list of upstream changes and release notes can be found here: https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-5546-changelog/
    last seen2020-06-05
    modified2015-12-18
    plugin id87486
    published2015-12-18
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87486
    titleopenSUSE Security Update : MariaDB 5.5.46 (openSUSE-2015-890)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2015-890.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(87486);
      script_version("2.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-4792", "CVE-2015-4802", "CVE-2015-4807", "CVE-2015-4815", "CVE-2015-4826", "CVE-2015-4830", "CVE-2015-4836", "CVE-2015-4858", "CVE-2015-4861", "CVE-2015-4870", "CVE-2015-4913");
    
      script_name(english:"openSUSE Security Update : MariaDB 5.5.46 (openSUSE-2015-890)");
      script_summary(english:"Check for the openSUSE-2015-890 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "MariaDB was updated to 5.5.46 to fix security issues and bugs.
    
    The following vulnerabilities were fixed in the upstream release :
    
    CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826,
    CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861,
    CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 
    
    A list of upstream changes and release notes can be found here:
    https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/
    https://mariadb.com/kb/en/mariadb/mariadb-5546-changelog/"
      );
      # https://mariadb.com/kb/en/mariadb/mariadb-5546-changelog/
      script_set_attribute(
        attribute:"see_also",
        value:"https://mariadb.com/kb/en/library/mariadb-5546-changelog/"
      );
      # https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/
      script_set_attribute(
        attribute:"see_also",
        value:"https://mariadb.com/kb/en/library/mariadb-5546-release-notes/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected MariaDB 5.5.46 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient18-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqlclient_r18-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libmysqld18-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-bench");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-bench-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-client-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-errormessages");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-test-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mariadb-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/10/21");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/12/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/18");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.1", reference:"libmysqlclient-devel-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libmysqlclient18-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libmysqlclient18-debuginfo-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libmysqlclient_r18-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libmysqld-devel-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libmysqld18-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libmysqld18-debuginfo-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-bench-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-bench-debuginfo-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-client-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-client-debuginfo-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-debuginfo-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-debugsource-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-errormessages-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-test-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-test-debuginfo-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-tools-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"mariadb-tools-debuginfo-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libmysqlclient18-32bit-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libmysqlclient18-debuginfo-32bit-5.5.46-13.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libmysqlclient_r18-32bit-5.5.46-13.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libmysqlclient-devel / libmysqlclient18-32bit / libmysqlclient18 / etc");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-65A1F22818.NASL
    descriptionThis is an update to 5.6.29 that delivers also all fixes for CVE-2015-4766, CVE-2015-4791, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-10
    plugin id89800
    published2016-03-10
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89800
    titleFedora 23 : community-mysql-5.6.29-1.fc23 (2016-65a1f22818)
  • NASL familyDatabases
    NASL idMYSQL_5_5_46.NASL
    descriptionThe version of MySQL running on the remote host is 5.5.x prior to 5.5.46. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Client Programs subcomponent. A local attacker can exploit this to gain elevated privileges. (CVE-2015-4819) - An unspecified flaw exists in the Types subcomponent. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaws exist in the Security:Privileges subcomponent. An authenticated, remote attacker can exploit these to impact integrity. (CVE-2015-4830, CVE-2015-4864) - An unspecified flaw exists in the DLM subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2015-4879) - An unspecified flaw exists in the Server Security Encryption subcomponent that allows an authenticated, remote attacker to disclose sensitive information. (CVE-2015-7744) Additionally, unspecified denial of service vulnerabilities can also exist in the following MySQL subcomponents : - DDL (CVE-2015-4815) - DML (CVE-2015-4858, CVE-2015-4913) - InnoDB (CVE-2015-4816, CVE-2015-4861) - Parser (CVE-2015-4870) - Partition (CVE-2015-4792, CVE-2015-4802) - Query (CVE-2015-4807) - SP (CVE-2015-4836)
    last seen2020-06-01
    modified2020-06-02
    plugin id86546
    published2015-10-22
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86546
    titleMySQL 5.5.x < 5.5.46 Multiple Vulnerabilities
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2016-0534.NASL
    descriptionAn update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix(es) : * It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
    last seen2020-06-01
    modified2020-06-02
    plugin id90276
    published2016-04-01
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90276
    titleCentOS 7 : mariadb (CESA-2016:0534)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2016-1011.NASL
    descriptionAccording to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) - This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.(CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99774
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99774
    titleEulerOS 2.0 SP1 : mariadb (EulerOS-SA-2016-1011)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-868C170507.NASL
    descriptionThis is an update to 10.0.23 that delivers also all fixes for CVE-2015-4792, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-07
    plugin id89701
    published2016-03-07
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89701
    titleFedora 22 : mariadb-10.0.23-1.fc22 (2016-868c170507)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-889.NASL
    descriptionMySQL was updated to 5.6.27 to fix security issues and bugs. The following vulnerabilities were fixed as part of the upstream release [boo#951391]: CVE-2015-1793, CVE-2015-0286, CVE-2015-0288, CVE-2015-1789, CVE-2015-4730, CVE-2015-4766, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913 Details on these and other changes can be found at: http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-27.html The following security relevant changes are included additionally : - CVE-2015-3152: MySQL lacked SSL enforcement. Using --ssl-verify-server-cert and --ssl[-*] implies that the ssl connection is required. The mysql client will now print an error if ssl is required, but the server can not handle a ssl connection [boo#924663], [boo#928962]
    last seen2020-06-05
    modified2015-12-17
    plugin id87442
    published2015-12-17
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87442
    titleopenSUSE Security Update : mysql (openSUSE-2015-889) (BACKRONYM)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3385.NASL
    descriptionSeveral issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.22. Please see the MariaDB 10.0 Release Notes for further details : - https://mariadb.com/kb/en/mariadb/mariadb-10021-release- notes/ - https://mariadb.com/kb/en/mariadb/mariadb-10022-release- notes/
    last seen2020-06-01
    modified2020-06-02
    plugin id86679
    published2015-11-02
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86679
    titleDebian DSA-3385-1 : mariadb-10.0 - security update
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2016-684.NASL
    descriptionwolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, also known as a Lenstra attack. (CVE-2015-7744) Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. (CVE-2015-4864) Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4866) Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4861) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2015-4862) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0616) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached. (CVE-2015-4910) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858 . (CVE-2015-4913) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0610) Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0594) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0595) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0596) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0597) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0598) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802 . (CVE-2015-4792) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges. (CVE-2015-4791) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via unknown vectors related to Server : Query Cache. (CVE-2015-4807) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser. (CVE-2015-4870) Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0599) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. (CVE-2016-0546) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913 . (CVE-2015-4858) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL. (CVE-2015-4815) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition. (CVE-2015-4833) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. (CVE-2015-4830) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP. (CVE-2015-4836) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to UDF. (CVE-2016-0608) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to privileges. (CVE-2016-0609) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Options. (CVE-2016-0505) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503 . (CVE-2016-0504) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication. (CVE-2015-4890) Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Partition. (CVE-2016-0601) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to libmysqld. (CVE-2015-4904) Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML. (CVE-2015-4905) Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors. (CVE-2016-0605) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect integrity via unknown vectors related to encryption. (CVE-2016-0606) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect availability via unknown vectors related to Server : Security : Firewall. (CVE-2015-4766) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0611) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to replication. (CVE-2016-0607) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs. (CVE-2015-4819) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML. (CVE-2015-4879) Unspecified vulnerability in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0502) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4895) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504 . (CVE-2016-0503) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0600) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792 . (CVE-2015-4802) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. (CVE-2015-4800) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types. (CVE-2015-4826)
    last seen2020-06-01
    modified2020-06-02
    plugin id90366
    published2016-04-07
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90366
    titleAmazon Linux AMI : mysql56 (ALAS-2016-684)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20160404_MARIADB_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : - When more than one INSERT operation was executed concurrently on a non- empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
    last seen2020-03-18
    modified2016-04-05
    plugin id90345
    published2016-04-05
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90345
    titleScientific Linux Security Update : mariadb on SL7.x x86_64 (20160404)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0121-1.NASL
    descriptionMariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed : - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 - 10.0.21: CVE-2015-4816, CVE-2015-4819, CVE-2015-4879, CVE-2015-4895 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id87964
    published2016-01-18
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87964
    titleSUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0121-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-164.NASL
    descriptionMariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed : - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 - Fix information leak via mysql-systemd-helper script. (CVE-2015-5969, bsc#957174) For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents : - https://kb.askmonty.org/en/mariadb-10022-release-notes/ - https://kb.askmonty.org/en/mariadb-10022-changelog/ This update was imported from the SUSE:SLE-12-SP1:Update update project.
    last seen2020-06-05
    modified2016-02-08
    plugin id88615
    published2016-02-08
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88615
    titleopenSUSE Security Update : mariadb (openSUSE-2016-164)
  • NASL familyDatabases
    NASL idMYSQL_5_6_27_RPM.NASL
    descriptionThe version of Oracle MySQL installed on the remote host is 5.6.x prior to 5.6.27. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Types subcomponent. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaw exists in the Security:Privileges subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2015-4830) - An unspecified flaw exists in the Security:Encryption subcomponent. An unauthenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-7744) - An unspecified flaw exists in the Options subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3471) Additionally, unspecified denial of service vulnerabilities exist in the following MySQL subcomponents : - DDL (CVE-2015-4815) - DML (CVE-2015-4858, CVE-2015-4862, CVE-2015-4913) - General (CVE-2016-0605) - InnoDB (CVE-2015-4861) - Memcached (CVE-2015-4910) - Optimizer (CVE-2015-4800) - Parser (CVE-2015-4870) - Partition (CVE-2015-4792, CVE-2015-4802) - Replication (CVE-2015-4890) - Security:Privileges (CVE-2015-4791) - SP (CVE-2015-4836)
    last seen2020-06-04
    modified2015-10-29
    plugin id86661
    published2015-10-29
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86661
    titleOracle MySQL 5.6.x < 5.6.27 Multiple Vulnerabilities (October 2015 CPU) (January 2016 CPU) (July 2016 CPU)
  • NASL familyDatabases
    NASL idMYSQL_5_5_46_RPM.NASL
    descriptionThe version of Oracle MySQL installed on the remote host is 5.5.x prior to 5.5.46. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Types subcomponent. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaw exists in the Security:Privileges subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2015-4830) - An unspecified flaw exists in the Security:Encryption subcomponent. An unauthenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-7744) - An unspecified flaw exists in the Options subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-3471) Additionally, unspecified denial of service vulnerabilities exist in the following MySQL subcomponents : - DDL (CVE-2015-4815) - DML (CVE-2015-4858, CVE-2015-4913) - InnoDB (CVE-2015-4861) - Parser (CVE-2015-4870) - Partition (CVE-2015-4792, CVE-2015-4802) - SP (CVE-2015-4836)
    last seen2020-06-04
    modified2015-10-29
    plugin id86658
    published2015-10-29
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86658
    titleOracle MySQL 5.5.x < 5.5.46 Multiple Vulnerabilities (October 2015 CPU) (January 2016 CPU) (July 2016 CPU)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_851A0EEA88AA11E590E7B499BAEBFEAF.NASL
    descriptionOracle reports : Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior
    last seen2020-06-01
    modified2020-06-02
    plugin id86858
    published2015-11-12
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86858
    titleFreeBSD : MySQL - Multiple vulnerabilities (851a0eea-88aa-11e5-90e7-b499baebfeaf)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-2303-1.NASL
    descriptionThe mysql package was updated to version 5.5.46 to fixs several security and non security issues. - bnc#951391: update to version 5.5.46 - changes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5- 46.html - fixed CVEs: CVE-2015-1793, CVE-2015-0286, CVE-2015-0288, CVE-2015-1789, CVE-2015-4730, CVE-2015-4766, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913 - bnc#952196: Fixed a build error for ppc*, s390* and ia64 architectures. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id87525
    published2015-12-21
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87525
    titleSUSE SLED11 / SLES11 Security Update : mysql (SUSE-SU-2015:2303-1)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2016-0534.NASL
    descriptionFrom Red Hat Security Advisory 2016:0534 : An update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix(es) : * It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
    last seen2020-06-01
    modified2020-06-02
    plugin id90296
    published2016-04-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90296
    titleOracle Linux 7 : mariadb (ELSA-2016-0534)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2781-1.NASL
    descriptionMultiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.5.46 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 15.04 and Ubuntu 15.10 have been updated to MySQL 5.6.27. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-45.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-26.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-27.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.h tml. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id86617
    published2015-10-27
    reporterUbuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86617
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : mysql-5.5, mysql-5.6 vulnerabilities (USN-2781-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3377.NASL
    descriptionSeveral issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.46. Please see the MySQL 5.5 Release Notes and Oracle
    last seen2020-06-01
    modified2020-06-02
    plugin id86580
    published2015-10-26
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86580
    titleDebian DSA-3377-1 : mysql-5.5 - security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-884.NASL
    descriptionMariaDB was updated to 10.0.22 to fix security issues and bugs. The following vulnerabilities were fixed in the upstream release : CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 A list of upstream changes and release notes can be found here : - https://kb.askmonty.org/en/mariadb-10022-release-notes/ - https://kb.askmonty.org/en/mariadb-10022-changelog/ The following build problems were fixed : - bsc#937787: fix main.bootstrap test (change default charset to utf8 in test result)
    last seen2020-06-05
    modified2015-12-17
    plugin id87440
    published2015-12-17
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87440
    titleopenSUSE Security Update : mariadb (openSUSE-2015-884)
  • NASL familyDatabases
    NASL idMYSQL_5_6_27.NASL
    descriptionThe version of MySQL running on the remote host is 5.6.x prior to 5.6.27. It is, therefore, potentially affected by the following vulnerabilities : - A certificate validation bypass vulnerability exists in the Security:Encryption subcomponent due to a flaw in the X509_verify_cert() function in x509_vfy.c that is triggered when locating alternate certificate chains when the first attempt to build such a chain fails. A remote attacker can exploit this, by using a valid leaf certificate as a certificate authority (CA), to issue invalid certificates that will bypass authentication. (CVE-2015-1793) - An unspecified flaw exists in the Client Programs subcomponent. A local attacker can exploit this to gain elevated privileges. (CVE-2015-4819) - An unspecified flaw exists in the Types subcomponent. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaws exist in the Security:Privileges subcomponent. An authenticated, remote attacker can exploit these to impact integrity. (CVE-2015-4830, CVE-2015-4864) - An unspecified flaw exists in the DLM subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2015-4879) - An unspecified flaw exists in the Server Security Encryption subcomponent that allows an authenticated, remote attacker to disclose sensitive information. (CVE-2015-7744) Additionally, unspecified denial of service vulnerabilities can also exist in the following MySQL subcomponents : - DDL (CVE-2015-4815) - DML (CVE-2015-4858, CVE-2015-4862, CVE-2015-4905, CVE-2015-4913) - InnoDB (CVE-2015-4861, CVE-2015-4866, CVE-2015-4895) - libmysqld (CVE-2015-4904) - Memcached (CVE-2015-4910) - Optimizer (CVE-2015-4800) - Parser (CVE-2015-4870) - Partition (CVE-2015-4792, CVE-2015-4802, CVE-2015-4833) - Query (CVE-2015-4807) - Replication (CVE-2015-4890) - Security : Firewall (CVE-2015-4766) - Server : General (CVE-2016-0605) - Security : Privileges (CVE-2015-4791) - SP (CVE-2015-4836) - Types (CVE-2015-4730)
    last seen2020-06-01
    modified2020-06-02
    plugin id86547
    published2015-10-22
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86547
    titleMySQL 5.6.x < 5.6.27 Multiple Vulnerabilities
  • NASL familyDatabases
    NASL idMARIADB_5_5_46.NASL
    descriptionThe version of MariaDB running on the remote host is prior to 5.5.46. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified flaws exist related to the Partition subcomponent that allow an authenticated, remote attacker to cause a denial of service. (CVE-2015-4802, CVE-2015-4792) - An unspecified flaw exists related to the Query Cache subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4807) - An unspecified flaw exists related to the DDL subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4815) - An unspecified flaw exists related to the Types subcomponent that allows an authenticated, remote attacker to gain access to sensitive information. (CVE-2015-4826) - An unspecified flaw exists related to the Security:Privileges subcomponent that allows an authenticated, remote attacker to affect the integrity of the system. No other details are available. (CVE-2015-4830) - An unspecified flaw exists related to the SP subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4836) - Multiple unspecified flaws exist related to the DML subcomponent that allow an authenticated, remote attacker to cause a denial of service. (CVE-2015-4858, CVE-2015-4913) - An unspecified flaw exists related to the InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4861) - An unspecified flaw exists related to the Parser subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2015-4870) - A flaw exists in the mysql_prepare_create_table() function due to improper handling of a comma buffer that is greater than zero. An authenticated, remote attacker can exploit this to cause a denial of service condition.
    last seen2020-06-01
    modified2020-06-02
    plugin id87210
    published2015-12-04
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87210
    titleMariaDB < 5.5.46 Multiple Vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-E30164D0A2.NASL
    descriptionThis is an update to 10.0.23 that delivers also all fixes for CVE-2015-4792, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-04
    plugin id89628
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89628
    titleFedora 23 : mariadb-10.0.23-1.fc23 (2016-e30164d0a2)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-0534.NASL
    descriptionAn update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix(es) : * It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
    last seen2020-06-01
    modified2020-06-02
    plugin id90300
    published2016-04-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90300
    titleRHEL 7 : mariadb (RHSA-2016:0534)
  • NASL familyDatabases
    NASL idMARIADB_10_0_22.NASL
    descriptionThe version of MariaDB running on the remote host is 10.0.x prior to 10.0.22. It is, therefore, affected by multiple vulnerabilities : - Multiple denial of service vulnerabilities exist due to multiple unspecified flaws in the
    last seen2020-06-01
    modified2020-06-02
    plugin id86874
    published2015-11-13
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86874
    titleMariaDB 10.0.x < 10.0.22 Multiple Vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-5CB344DD7E.NASL
    descriptionThis is an update to 5.6.29 that delivers also all fixes for CVE-2015-4766, CVE-2015-4791, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-10
    plugin id89799
    published2016-03-10
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89799
    titleFedora 22 : community-mysql-5.6.29-1.fc22 (2016-5cb344dd7e)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0296-1.NASL
    descriptionMariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed : - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 - Fix information leak via mysql-systemd-helper script. (CVE-2015-5969, bsc#957174) For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents : - https://kb.askmonty.org/en/mariadb-10022-release-notes/ - https://kb.askmonty.org/en/mariadb-10022-changelog/ Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id88515
    published2016-02-02
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88515
    titleSUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0296-1)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/137232/mysqlprocedure-dos.txt
idPACKETSTORM:137232
last seen2016-12-05
published2016-05-28
reporterOsanda Malith
sourcehttps://packetstormsecurity.com/files/137232/MySQL-Procedure-Analyse-Denial-Of-Service.html
titleMySQL Procedure Analyse Denial Of Service

Redhat

advisories
  • rhsa
    idRHSA-2016:0534
  • rhsa
    idRHSA-2016:0705
  • rhsa
    idRHSA-2016:1132
  • rhsa
    idRHSA-2016:1480
  • rhsa
    idRHSA-2016:1481
rpms
  • mariadb-1:5.5.47-1.el7_2
  • mariadb-bench-1:5.5.47-1.el7_2
  • mariadb-debuginfo-1:5.5.47-1.el7_2
  • mariadb-devel-1:5.5.47-1.el7_2
  • mariadb-embedded-1:5.5.47-1.el7_2
  • mariadb-embedded-devel-1:5.5.47-1.el7_2
  • mariadb-libs-1:5.5.47-1.el7_2
  • mariadb-server-1:5.5.47-1.el7_2
  • mariadb-test-1:5.5.47-1.el7_2
  • rh-mysql56-mysql-0:5.6.30-1.el6
  • rh-mysql56-mysql-0:5.6.30-1.el7
  • rh-mysql56-mysql-bench-0:5.6.30-1.el6
  • rh-mysql56-mysql-bench-0:5.6.30-1.el7
  • rh-mysql56-mysql-common-0:5.6.30-1.el6
  • rh-mysql56-mysql-common-0:5.6.30-1.el7
  • rh-mysql56-mysql-config-0:5.6.30-1.el6
  • rh-mysql56-mysql-config-0:5.6.30-1.el7
  • rh-mysql56-mysql-debuginfo-0:5.6.30-1.el6
  • rh-mysql56-mysql-debuginfo-0:5.6.30-1.el7
  • rh-mysql56-mysql-devel-0:5.6.30-1.el6
  • rh-mysql56-mysql-devel-0:5.6.30-1.el7
  • rh-mysql56-mysql-errmsg-0:5.6.30-1.el6
  • rh-mysql56-mysql-errmsg-0:5.6.30-1.el7
  • rh-mysql56-mysql-server-0:5.6.30-1.el6
  • rh-mysql56-mysql-server-0:5.6.30-1.el7
  • rh-mysql56-mysql-test-0:5.6.30-1.el6
  • rh-mysql56-mysql-test-0:5.6.30-1.el7
  • rh-mariadb100-mariadb-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-bench-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-bench-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-common-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-common-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-config-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-config-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-debuginfo-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-debuginfo-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-devel-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-devel-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-errmsg-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-errmsg-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-oqgraph-engine-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-oqgraph-engine-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-server-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-server-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-test-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-test-1:10.0.25-4.el7
  • mysql55-mysql-0:5.5.50-1.el6
  • mysql55-mysql-0:5.5.50-1.el7
  • mysql55-mysql-bench-0:5.5.50-1.el6
  • mysql55-mysql-bench-0:5.5.50-1.el7
  • mysql55-mysql-debuginfo-0:5.5.50-1.el6
  • mysql55-mysql-debuginfo-0:5.5.50-1.el7
  • mysql55-mysql-devel-0:5.5.50-1.el6
  • mysql55-mysql-devel-0:5.5.50-1.el7
  • mysql55-mysql-libs-0:5.5.50-1.el6
  • mysql55-mysql-libs-0:5.5.50-1.el7
  • mysql55-mysql-server-0:5.5.50-1.el6
  • mysql55-mysql-server-0:5.5.50-1.el7
  • mysql55-mysql-test-0:5.5.50-1.el6
  • mysql55-mysql-test-0:5.5.50-1.el7
  • mariadb55-mariadb-0:5.5.49-1.el6
  • mariadb55-mariadb-0:5.5.49-1.el7
  • mariadb55-mariadb-bench-0:5.5.49-1.el6
  • mariadb55-mariadb-bench-0:5.5.49-1.el7
  • mariadb55-mariadb-debuginfo-0:5.5.49-1.el6
  • mariadb55-mariadb-debuginfo-0:5.5.49-1.el7
  • mariadb55-mariadb-devel-0:5.5.49-1.el6
  • mariadb55-mariadb-devel-0:5.5.49-1.el7
  • mariadb55-mariadb-libs-0:5.5.49-1.el6
  • mariadb55-mariadb-libs-0:5.5.49-1.el7
  • mariadb55-mariadb-server-0:5.5.49-1.el6
  • mariadb55-mariadb-server-0:5.5.49-1.el7
  • mariadb55-mariadb-test-0:5.5.49-1.el6
  • mariadb55-mariadb-test-0:5.5.49-1.el7