Vulnerabilities > CVE-2016-0609 - Remote Security vulnerability in Oracle MySQL

047910
CVSS 1.7 - LOW
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
MULTIPLE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
high complexity
oracle
redhat
debian
opensuse
canonical
mariadb
nessus

Summary

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges.

Vulnerable Configurations

Part Description Count
OS
Oracle
2
OS
Redhat
9
OS
Debian
1
OS
Opensuse
2
OS
Canonical
4
Application
Mariadb
49
Application
Oracle
90

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1619-1.NASL
    descriptionmariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed : - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject
    last seen2020-06-01
    modified2020-06-02
    plugin id93158
    published2016-08-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93158
    titleSUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1619-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2016:1619-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(93158);
      script_version("2.8");
      script_cvs_date("Date: 2019/09/11 11:22:13");
    
      script_cve_id("CVE-2016-0505", "CVE-2016-0546", "CVE-2016-0596", "CVE-2016-0597", "CVE-2016-0598", "CVE-2016-0600", "CVE-2016-0606", "CVE-2016-0608", "CVE-2016-0609", "CVE-2016-0616", "CVE-2016-0640", "CVE-2016-0641", "CVE-2016-0642", "CVE-2016-0643", "CVE-2016-0644", "CVE-2016-0646", "CVE-2016-0647", "CVE-2016-0648", "CVE-2016-0649", "CVE-2016-0650", "CVE-2016-0651", "CVE-2016-0655", "CVE-2016-0666", "CVE-2016-0668", "CVE-2016-2047");
    
      script_name(english:"SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1619-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "mariadb was updated to version 10.0.25 to fix 25 security issues.
    
    These security issues were fixed :
    
      - CVE-2016-0505: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to Options (bsc#980904).
    
      - CVE-2016-0546: Unspecified vulnerability allowed local
        users to affect confidentiality, integrity, and
        availability via unknown vectors related to Client
        (bsc#980904).
    
      - CVE-2016-0596: Unspecified vulnerability allowed remote
        authenticated users to affect availability via vectors
        related to DML (bsc#980904).
    
      - CVE-2016-0597: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to Optimizer (bsc#980904).
    
      - CVE-2016-0598: Unspecified vulnerability allowed remote
        authenticated users to affect availability via vectors
        related to DML (bsc#980904).
    
      - CVE-2016-0600: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to InnoDB (bsc#980904).
    
      - CVE-2016-0606: Unspecified vulnerability allowed remote
        authenticated users to affect integrity via unknown
        vectors related to encryption (bsc#980904).
    
      - CVE-2016-0608: Unspecified vulnerability allowed remote
        authenticated users to affect availability via vectors
        related to UDF (bsc#980904).
    
      - CVE-2016-0609: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to privileges (bsc#980904).
    
      - CVE-2016-0616: Unspecified vulnerability allowed remote
        authenticated users to affect availability via unknown
        vectors related to Optimizer (bsc#980904).
    
      - CVE-2016-0640: Unspecified vulnerability allowed local
        users to affect integrity and availability via vectors
        related to DML (bsc#980904).
    
      - CVE-2016-0641: Unspecified vulnerability allowed local
        users to affect confidentiality and availability via
        vectors related to MyISAM (bsc#980904).
    
      - CVE-2016-0642: Unspecified vulnerability allowed local
        users to affect integrity and availability via vectors
        related to Federated (bsc#980904).
    
      - CVE-2016-0643: Unspecified vulnerability allowed local
        users to affect confidentiality via vectors related to
        DML (bsc#980904).
    
      - CVE-2016-0644: Unspecified vulnerability allowed local
        users to affect availability via vectors related to DDL
        (bsc#980904).
    
      - CVE-2016-0646: Unspecified vulnerability allowed local
        users to affect availability via vectors related to DML
        (bsc#980904).
    
      - CVE-2016-0647: Unspecified vulnerability allowed local
        users to affect availability via vectors related to FTS
        (bsc#980904).
    
      - CVE-2016-0648: Unspecified vulnerability allowed local
        users to affect availability via vectors related to PS
        (bsc#980904).
    
      - CVE-2016-0649: Unspecified vulnerability allowed local
        users to affect availability via vectors related to PS
        (bsc#980904).
    
      - CVE-2016-0650: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        Replication (bsc#980904).
    
      - CVE-2016-0651: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        Optimizer (bsc#980904).
    
      - CVE-2016-0655: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        InnoDB (bsc#980904).
    
      - CVE-2016-0666: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        Security: Privileges (bsc#980904).
    
      - CVE-2016-0668: Unspecified vulnerability allowed local
        users to affect availability via vectors related to
        InnoDB (bsc#980904).
    
      - CVE-2016-2047: The ssl_verify_server_cert function in
        sql-common/client.c did not properly verify that the
        server hostname matches a domain name in the subject's
        Common Name (CN) or subjectAltName field of the X.509
        certificate, which allowed man-in-the-middle attackers
        to spoof SSL servers via a '/CN=' string in a field in a
        certificate, as demonstrated by
        '/OU=/CN=bar.com/CN=foo.com (bsc#963806).
    
    The update package also includes non-security fixes. See advisory for
    details.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=960961"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=961935"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=963806"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=980904"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0505/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0546/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0596/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0597/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0598/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0600/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0606/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0608/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0609/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0616/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0640/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0641/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0642/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0643/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0644/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0646/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0647/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0648/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0649/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0650/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0651/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0655/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0666/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-0668/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-2047/"
      );
      # https://www.suse.com/support/update/announcement/2016/suse-su-20161619-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?26886a56"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Workstation Extension 12 :
    
    zypper in -t patch SUSE-SLE-WE-12-2016-964=1
    
    SUSE Linux Enterprise Software Development Kit 12 :
    
    zypper in -t patch SUSE-SLE-SDK-12-2016-964=1
    
    SUSE Linux Enterprise Server 12 :
    
    zypper in -t patch SUSE-SLE-SERVER-12-2016-964=1
    
    SUSE Linux Enterprise Desktop 12 :
    
    zypper in -t patch SUSE-SLE-DESKTOP-12-2016-964=1
    
    To bring your system up-to-date, use 'zypper patch'."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libmysqlclient18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libmysqlclient18-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libmysqlclient_r18");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-client-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-errormessages");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:mariadb-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/06/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/08/29");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES12" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0", os_ver + " SP" + sp);
    if (os_ver == "SLED12" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP0", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libmysqlclient18-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libmysqlclient18-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-client-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-client-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-debugsource-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-errormessages-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-tools-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"mariadb-tools-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libmysqlclient18-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libmysqlclient18-debuginfo-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient18-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient18-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient18-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient18-debuginfo-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient_r18-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libmysqlclient_r18-32bit-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-client-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-client-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-debuginfo-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-debugsource-10.0.25-20.6.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"mariadb-errormessages-10.0.25-20.6.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mariadb");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-65A1F22818.NASL
    descriptionThis is an update to 5.6.29 that delivers also all fixes for CVE-2015-4766, CVE-2015-4791, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-10
    plugin id89800
    published2016-03-10
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89800
    titleFedora 23 : community-mysql-5.6.29-1.fc23 (2016-65a1f22818)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3453.NASL
    descriptionSeveral issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.23. Please see the MariaDB 10.0 Release Notes for further details : - https://mariadb.com/kb/en/mariadb/mariadb-10023-release- notes/
    last seen2020-06-01
    modified2020-06-02
    plugin id88389
    published2016-01-27
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88389
    titleDebian DSA-3453-1 : mariadb-10.0 - security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-409.NASL
    descriptionSeveral issues have been found in the MySQL database server. These issues have been addressed by upgrading to the most recent upstream release of MySQL, 5.5.47. Please, look at the MySQL 5.5 Release Notes and Oracle
    last seen2020-03-17
    modified2016-02-02
    plugin id88511
    published2016-02-02
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88511
    titleDebian DLA-409-1 : mysql-5.5 security update
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2016-0534.NASL
    descriptionAn update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix(es) : * It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
    last seen2020-06-01
    modified2020-06-02
    plugin id90276
    published2016-04-01
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90276
    titleCentOS 7 : mariadb (CESA-2016:0534)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-780.NASL
    descriptionmariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed : - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject
    last seen2020-06-05
    modified2016-06-28
    plugin id91871
    published2016-06-28
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91871
    titleopenSUSE Security Update : mariadb (openSUSE-2016-780)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2016-1011.NASL
    descriptionAccording to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) - This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.(CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99774
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99774
    titleEulerOS 2.0 SP1 : mariadb (EulerOS-SA-2016-1011)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-868C170507.NASL
    descriptionThis is an update to 10.0.23 that delivers also all fixes for CVE-2015-4792, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-07
    plugin id89701
    published2016-03-07
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89701
    titleFedora 22 : mariadb-10.0.23-1.fc22 (2016-868c170507)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1554.NASL
    descriptionAccording to the versions of the mariadb packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML.(CVE-2016-0643) - Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to UDF.(CVE-2016-0608) - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DDL.(CVE-2016-0644) - Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML.(CVE-2014-6507) - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DML.(CVE-2016-0646) - Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.(CVE-2016-0600) - Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.(CVE-2016-0597) - Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string.(CVE-2014-0001) - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to PS.(CVE-2016-0648) - Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.(CVE-2016-0596) - Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.(CVE-2016-0616) - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to PS.(CVE-2016-0649) - It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the
    last seen2020-06-01
    modified2020-06-02
    plugin id125007
    published2019-05-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125007
    titleEulerOS Virtualization 3.0.1.0 : mariadb (EulerOS-SA-2019-1554)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2881-1.NASL
    descriptionMultiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.5.47 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 15.04 and Ubuntu 15.10 have been updated to MySQL 5.6.28. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-47.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-28.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.h tml. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id88409
    published2016-01-27
    reporterUbuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88409
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : mysql-5.5, mysql-5.6 vulnerabilities (USN-2881-1)
  • NASL familyDatabases
    NASL idMARIADB_5_5_47.NASL
    descriptionThe version of MariaDB running on the remote host is 5.5.x prior to 5.5.47. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Server : Options subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0505) - An unspecified flaw exists in the Client subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-0546) - An unspecified flaw exists in the Server : DML subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0596) - Multiple unspecified flaws exist in the Server : Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616) - An unspecified flaw exists in the Server : InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0600) - An unspecified flaw exists in the Server : Security : Encryption subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-0606, CVE-2016-0609) - An unspecified flaw exists in the Server : UDF subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0608) - A security bypass vulnerability exists due to an incorrect implementation of the --ssl-verify-server-cert option. A man-in-the-middle attacker can exploit this to replace the server SSL certificate, resulting in a bypass of the client-side hostname verification. (MDEV-9212)
    last seen2020-06-01
    modified2020-06-02
    plugin id87727
    published2016-01-04
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87727
    titleMariaDB 5.5 < 5.5.47 Multiple Vulnerabilities
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2016-738.NASL
    descriptionIt was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to UDF. (CVE-2016-0608) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to privileges. (CVE-2016-0609) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Options. (CVE-2016-0505) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0600) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0616) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption. (CVE-2016-3452) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DDL. (CVE-2016-0644) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser. (CVE-2016-3477) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0596) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0597) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect integrity and availability via vectors related to DML. (CVE-2016-0640) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. (CVE-2016-3521) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect integrity and availability via vectors related to Federated. (CVE-2016-0642) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect confidentiality via vectors related to DML. (CVE-2016-0643) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to Security: Privileges. (CVE-2016-0666) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer. (CVE-2016-0651) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to Replication. (CVE-2016-0650) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0598) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to PS. (CVE-2016-0649) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote administrators to affect availability via vectors related to Server: RBR. (CVE-2016-5440) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Connection. (CVE-2016-5444) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect integrity via unknown vectors related to encryption. (CVE-2016-0606) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to PS. (CVE-2016-0648) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DML. (CVE-2016-0646) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. (CVE-2016-0546) Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to FTS. (CVE-2016-0647) Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: DML. (CVE-2016-3615) Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect confidentiality and availability via vectors related to MyISAM. (CVE-2016-0641)
    last seen2020-06-01
    modified2020-06-02
    plugin id93016
    published2016-08-18
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93016
    titleAmazon Linux AMI : mysql55 (ALAS-2016-738)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-169.NASL
    descriptionThis update to MySQL 5.6.28 fixes the following issues (bsc#962779) : - CVE-2015-7744: Lack of verification against faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack. - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0503: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504. - CVE-2016-0504: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503. - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Options. - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. - CVE-2016-0594: Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0595: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0605: Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors. - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect integrity via unknown vectors related to encryption. - CVE-2016-0607: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to replication. - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to UDF. - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to privileges. - CVE-2016-0610: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0611: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - bsc#959724: Possible buffer overflow from incorrect use of strcpy() and sprintf()
    last seen2020-06-05
    modified2016-02-09
    plugin id88633
    published2016-02-09
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88633
    titleopenSUSE Security Update : MySQL (openSUSE-2016-169)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-165.NASL
    descriptionThis update to MySQL 5.6.28 fixes the following issues (bsc#962779) : - CVE-2015-7744: Lack of verification against faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack. - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0503: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504. - CVE-2016-0504: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503. - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Options. - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. - CVE-2016-0594: Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0595: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0605: Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors. - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect integrity via unknown vectors related to encryption. - CVE-2016-0607: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to replication. - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to UDF. - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to privileges. - CVE-2016-0610: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0611: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2015-5969: Fixed information leak via mysql-systemd-helper script. (bsc#957174) - bsc#959724: Possible buffer overflow from incorrect use of strcpy() and sprintf()
    last seen2020-06-05
    modified2016-02-08
    plugin id88616
    published2016-02-08
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88616
    titleopenSUSE Security Update : MySQL (openSUSE-2016-165)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2016-684.NASL
    descriptionwolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, also known as a Lenstra attack. (CVE-2015-7744) Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. (CVE-2015-4864) Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4866) Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4861) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2015-4862) Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0616) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached. (CVE-2015-4910) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858 . (CVE-2015-4913) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0610) Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0594) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0595) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0596) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0597) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0598) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802 . (CVE-2015-4792) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges. (CVE-2015-4791) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via unknown vectors related to Server : Query Cache. (CVE-2015-4807) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser. (CVE-2015-4870) Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0599) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. (CVE-2016-0546) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913 . (CVE-2015-4858) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL. (CVE-2015-4815) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition. (CVE-2015-4833) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. (CVE-2015-4830) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP. (CVE-2015-4836) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to UDF. (CVE-2016-0608) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to privileges. (CVE-2016-0609) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Options. (CVE-2016-0505) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503 . (CVE-2016-0504) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication. (CVE-2015-4890) Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Partition. (CVE-2016-0601) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to libmysqld. (CVE-2015-4904) Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML. (CVE-2015-4905) Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors. (CVE-2016-0605) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect integrity via unknown vectors related to encryption. (CVE-2016-0606) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect availability via unknown vectors related to Server : Security : Firewall. (CVE-2015-4766) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0611) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to replication. (CVE-2016-0607) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs. (CVE-2015-4819) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML. (CVE-2015-4879) Unspecified vulnerability in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0502) Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4895) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504 . (CVE-2016-0503) Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0600) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792 . (CVE-2015-4802) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. (CVE-2015-4800) Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types. (CVE-2015-4826)
    last seen2020-06-01
    modified2020-06-02
    plugin id90366
    published2016-04-07
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90366
    titleAmazon Linux AMI : mysql56 (ALAS-2016-684)
  • NASL familyDatabases
    NASL idMYSQL_5_7_10.NASL
    descriptionThe version of MySQL running on the remote host is 5.7.x prior to 5.7.10. It is, therefore, potentially affected by the following vulnerabilities : - Multiple unspecified flaws exists in the Server : DML subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0503, CVE-2016-0504) - An unspecified flaw exists in the Server : Options subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0505) - An unspecified flaw exists in the Client subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-0546) - Multiple unspecified flaws exist in the Server : Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0611) - An unspecified flaw exists in the Server : InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0600) - An unspecified flaw exists in the Server : Partition subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0601) - An unspecified flaw exists in the Server : Security : Encryption subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-0606, CVE-2016-0609) - An unspecified flaw exists in the Server : Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0607) - An unspecified flaw exists in the Server : UDF subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0608) - A denial of service vulnerability exists due to repeatedly executing a prepared statement when the default database has been changed. An authenticated, remote attacker can exploit this to cause the server to exit. - A denial of service vulnerability exists due to a use-after-free error that is triggered when generated column expressions are reevaluated. An authenticated, remote attacker can exploit this to deference already freed memory, thus causing the server to exit. - A denial of service vulnerability exists due to a flaw that is triggered when selecting DECIMAL values into user-defined variables. An authenticated, remote attacker can exploit this to cause the server to exit. - A denial of service vulnerability exists due to a use-after-free error in spatial functions. An authenticated, remote attacker can exploit this to deference already freed memory, thus causing the server to exit. - A flaw exists in the Server : InnoDB subcomponent due to a failure to check for destination files with the same name when using the ALTER TABLE operation to convert a table to an InnoDB file-per-table tablespace. An authenticated, remote attacker can exploit this to cause a denial of service. - A NULL pointer dereference flaw exists in the Server : InnoDB subcomponent due to a failure to properly check the return value of an unspecified function call used in a DROP TABLE operation. An authenticated, remote attacker can exploit this to cause a denial of service. - A flaw exists in the Server : InnoDB subcomponent in the row_quiesce_table_start() function that is triggered when running a
    last seen2020-06-01
    modified2020-06-02
    plugin id87421
    published2015-12-16
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87421
    titleMySQL 5.7.x < 5.7.10 Multiple DoS
  • NASL familyDatabases
    NASL idMYSQL_5_7_10_RPM.NASL
    descriptionThe version of Oracle MySQL installed on the remote host is 5.7.x prior to 5.7.10. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Client subcomponent. A local attacker can exploit this to execute arbitrary code. (CVE-2016-0546) - An unspecified flaw exists in the Security:Encryption subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2016-0606) Additionally, unspecified denial of service vulnerabilities exist in the following MySQL subcomponents : - DML (CVE-2016-0503, CVE-2016-0504, CVE-2016-0598) - InnoDB (CVE-2016-0600) - Optimizer (CVE-2016-0597, CVE-2016-0599, CVE-2016-0611) - Options (CVE-2016-0505) - Partition (CVE-2016-0601) - Replication (CVE-2016-0607) - Security:Privileges (CVE-2016-0609) - UDF (CVE-2016-0608)
    last seen2020-06-04
    modified2016-01-26
    plugin id88384
    published2016-01-26
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88384
    titleOracle MySQL 5.7.x < 5.7.10 Multiple Vulnerabilities (January 2016 CPU)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20160404_MARIADB_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : - When more than one INSERT operation was executed concurrently on a non- empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
    last seen2020-03-18
    modified2016-04-05
    plugin id90345
    published2016-04-05
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90345
    titleScientific Linux Security Update : mariadb on SL7.x x86_64 (20160404)
  • NASL familyDatabases
    NASL idMYSQL_5_6_28.NASL
    descriptionThe version of MySQL running on the remote host is 5.6.x prior to 5.6.28. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified flaws exists in the Server : DML subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0503, CVE-2016-0504, CVE-2016-0595, CVE-2016-0596) - An unspecified flaw exists in the Server : Options subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0505) - An unspecified flaw exists in the Client subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-0546) - Multiple unspecified flaws exist in the Server : Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0597, CVE-2016-0598, CVE-2016-0611) - An unspecified flaw exists in the Server : InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0600, CVE-2016-0610) - An unspecified flaw exists in the Server : Security : Encryption subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-0606, CVE-2016-0609) - An unspecified flaw exists in the Server : Replication subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0607) - An unspecified flaw exists in the Server : UDF subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0608) - A denial of service vulnerability exists due to repeatedly executing a prepared statement when the default database has been changed. An authenticated, remote attacker can exploit this to cause the server to exit. - A denial of service vulnerability exists due to a flaw that is triggered when selecting DECIMAL values into user-defined variables. An authenticated, remote attacker can exploit this to cause the server to exit. - A flaw exists in the Server : InnoDB subcomponent due to a failure to check for destination files with the same name when using the ALTER TABLE operation to convert a table to an InnoDB file-per-table tablespace. An authenticated, remote attacker can exploit this to cause a denial of service. - A denial of service vulnerability exists that is triggered when updating views using ALL comparison operators on subqueries that select from indexed columns in the main table. An authenticated, remote attacker can exploit this to cause the server to exit, resulting in a denial of service condition. - A flaw exists in the Server : InnoDB subcomponent that is triggered when handling ALTER TABLE operations. An authenticated, remote attacker can exploit this to cause a denial of service condition. - A remote code execution vulnerability exists due to improper validation of user-supplied input to the strcpy() and sprintf() functions. An authenticated, remote attacker can exploit this to cause a buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. - A denial of service vulnerability exists due to a flaw that is triggered when selecting DECIMAL values into user-defined variables. An authenticated, remote attacker can exploit this to cause the server to exit. - A denial of service vulnerability exists that is triggered when handling concurrent FLUSH PRIVILEGES and REVOKE or GRANT statements. An authenticated, remote attacker can exploit this to cause the server to exit by triggering an invalid memory access to proxy user information. - A denial of service vulnerability exists that is triggered on the second execution of a prepared statement where an ORDER BY clause references a column position. An authenticated, remote attacker can exploit this to cause the server to exit. - A denial of service vulnerability exists in the Server : Optimizer subcomponent due to accessing a stale pointer when handling filesorts for UPDATE statements. An authenticated, remote attacker can exploit this to cause to server to exit.
    last seen2020-06-01
    modified2020-06-02
    plugin id87420
    published2015-12-16
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87420
    titleMySQL 5.6.x < 5.6.28 Multiple Vulnerabilities
  • NASL familyDatabases
    NASL idMYSQL_5_6_28_RPM.NASL
    descriptionThe version of Oracle MySQL installed on the remote host is 5.6.x prior to 5.6.28. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Client subcomponent. A local attacker can exploit this to execute arbitrary code. (CVE-2016-0546) - An unspecified flaw exists in the Security:Encryption subcomponent. An authenticated, remote attacker can exploit this to impact integrity. (CVE-2016-0606) Additionally, unspecified denial of service vulnerabilities exist in the following MySQL subcomponents : - DML (CVE-2016-0503, CVE-2016-0504, CVE-2016-0595, CVE-2016-0596, CVE-2016-0598) - InnoDB (CVE-2016-0600, CVE-2016-0610) - Optimizer (CVE-2016-0597, CVE-2016-0611) - Options (CVE-2016-0505) - Replication (CVE-2016-0607) - Security:Privileges (CVE-2016-0609) - UDF (CVE-2016-0608)
    last seen2020-06-04
    modified2016-01-26
    plugin id88383
    published2016-01-26
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88383
    titleOracle MySQL 5.6.x < 5.6.28 Multiple Vulnerabilities (January 2016 CPU)
  • NASL familyDatabases
    NASL idMYSQL_5_5_47_RPM.NASL
    descriptionThe version of Oracle MySQL installed on the remote host is 5.5.x prior to 5.5.47. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Server : Options subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0505) - An unspecified flaw exists in the Client subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-0546) - An unspecified flaw exists in the Server : DML subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0596) - Multiple unspecified flaws exist in the Server : Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616) - An unspecified flaw exists in the Server : InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0600) - An unspecified flaw exists in the Server : Security : Encryption subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-0606, CVE-2016-0609) - An unspecified flaw exists in the Server : UDF subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0608) - An unspecified flaw exists in the Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0651) - A denial of service vulnerability exists due to repeatedly executing a prepared statement when the default database has been changed. An authenticated, remote attacker can exploit this to cause the server to exit. - A denial of service vulnerability exists that is triggered when updating views using ALL comparison operators on subqueries that select from indexed columns in the main table. An authenticated, remote attacker can exploit this to cause the server to exit, resulting in a denial of service condition. - A remote code execution vulnerability exists due to improper validation of user-supplied input to the strcpy() and sprintf() functions. An authenticated, remote attacker can exploit this to cause a buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. - A denial of service vulnerability exists that is triggered when handling concurrent FLUSH PRIVILEGES and REVOKE or GRANT statements. An authenticated, remote attacker can exploit this to cause the server to exit by triggering an invalid memory access to proxy user information. - A denial of service vulnerability exists that is triggered on the second execution of a prepared statement where an ORDER BY clause references a column position. An authenticated, remote attacker can exploit this to cause the server to exit.
    last seen2020-06-04
    modified2016-01-26
    plugin id88380
    published2016-01-26
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88380
    titleOracle MySQL 5.5.x < 5.5.47 Multiple Vulnerabilities (January 2016 CPU) (April 2016 CPU)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3459.NASL
    descriptionSeveral issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.47. Please see the MySQL 5.5 Release Notes and Oracle
    last seen2020-06-01
    modified2020-06-02
    plugin id88462
    published2016-01-29
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88462
    titleDebian DSA-3459-1 : mysql-5.5 - security update
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2016-0534.NASL
    descriptionFrom Red Hat Security Advisory 2016:0534 : An update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix(es) : * It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
    last seen2020-06-01
    modified2020-06-02
    plugin id90296
    published2016-04-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90296
    titleOracle Linux 7 : mariadb (ELSA-2016-0534)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-761.NASL
    descriptionmariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed : - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject
    last seen2020-06-05
    modified2016-06-24
    plugin id91794
    published2016-06-24
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91794
    titleopenSUSE Security Update : mariadb (openSUSE-2016-761)
  • NASL familyDatabases
    NASL idMARIADB_10_1_10.NASL
    descriptionThe version of MariaDB running on the remote host is 10.1.x prior to 10.1.10. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Server : Options subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0505) - An unspecified flaw exists in the Client subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-0546) - An unspecified flaw exists in the Server : DML subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0596) - Multiple unspecified flaws exist in the Server : Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616) - An unspecified flaw exists in the Server : InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0600) - An unspecified flaw exists in the Server : Security : Encryption subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-0606, CVE-2016-0609) - An unspecified flaw exists in the Server : UDF subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0608) - A race condition exists due to debian.cnf being created with world-readable permissions for a small period of time during initial installation. A local attacker can exploit this to disclose the debian-sys-maint password. - A flaw exists in the decimal2string() function due to improper handling of decimal precision greater than 40. An authenticated, remote attacker can exploit this to crash the server, resulting in a denial of service condition. - A security bypass vulnerability exists due to an incorrect implementation of the --ssl-verify-server-cert option. A man-in-the-middle attacker can exploit this to replace the server SSL certificate, resulting in a bypass of the client-side hostname verification. (MDEV-9212)
    last seen2020-06-01
    modified2020-06-02
    plugin id87726
    published2016-01-04
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87726
    titleMariaDB 10.1.x < 10.1.10 Multiple Vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-E30164D0A2.NASL
    descriptionThis is an update to 10.0.23 that delivers also all fixes for CVE-2015-4792, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-04
    plugin id89628
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89628
    titleFedora 23 : mariadb-10.0.23-1.fc23 (2016-e30164d0a2)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-0534.NASL
    descriptionAn update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. Security Fix(es) : * It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047) * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616) Bug Fix(es) : * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a
    last seen2020-06-01
    modified2020-06-02
    plugin id90300
    published2016-04-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90300
    titleRHEL 7 : mariadb (RHSA-2016:0534)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-5CB344DD7E.NASL
    descriptionThis is an update to 5.6.29 that delivers also all fixes for CVE-2015-4766, CVE-2015-4791, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913, CVE-2015-7744, CVE-2016-0502, CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0594, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0599, CVE-2016-0600, CVE-2016-0601, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0611, CVE-2016-0616 (some of them were fixed in previous update already). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-10
    plugin id89799
    published2016-03-10
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89799
    titleFedora 22 : community-mysql-5.6.29-1.fc22 (2016-5cb344dd7e)
  • NASL familyDatabases
    NASL idMARIADB_10_0_23.NASL
    descriptionThe version of MariaDB running on the remote host is 10.0.x prior to 10.0.23. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Server : Options subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0505) - An unspecified flaw exists in the Client subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-0546) - An unspecified flaw exists in the Server : DML subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0596) - Multiple unspecified flaws exist in the Server : Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616) - An unspecified flaw exists in the Server : InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0600) - An unspecified flaw exists in the Server : Security : Encryption subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-0606, CVE-2016-0609) - An unspecified flaw exists in the Server : UDF subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0608) - A flaw exists in the check_fk_parent_table_access() function in sql_parse.cc that is triggered when performing database name conversions. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service. - An overflow condition exists in the XMLColumns() function in tabxml.cpp due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this to cause a buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. - An unspecified flaw exists that is triggered when handling UPDATE queries with JOIN. An authenticated, remote attacker can exploit this to crash the database, resulting in a denial of service. - A flaw exists in mysql_upgrade due to leaking plaintext password information to the process listing when spawning a shell process to execute mysqlcheck. A local attacker can exploit this to disclose sensitive password information. - An unspecified flaw exists that is triggered during the handling of
    last seen2020-06-01
    modified2020-06-02
    plugin id87725
    published2016-01-04
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87725
    titleMariaDB 10.0.x < 10.0.23 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1620-1.NASL
    descriptionmariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed : - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject
    last seen2020-06-01
    modified2020-06-02
    plugin id93159
    published2016-08-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93159
    titleSUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1620-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0348-1.NASL
    descriptionThis update to MySQL 5.5.47 fixes the following issues (bsc#962779) : - CVE-2015-7744: Lack of verification against faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack. - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Options. - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect integrity via unknown vectors related to encryption. - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to UDF. - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to privileges. - CVE-2016-0616: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - bsc#959724: Possible buffer overflow from incorrect use of strcpy() and sprintf() The following bugs were fixed : - bsc#960961: Incorrect use of plugin-load option in default_plugins.cnf Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id88623
    published2016-02-08
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88623
    titleSUSE SLED11 / SLES11 Security Update : mysql (SUSE-SU-2016:0348-1)
  • NASL familyDatabases
    NASL idMYSQL_5_5_47.NASL
    descriptionThe version of MySQL running on the remote host is 5.5.x prior to 5.5.47. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Server : Options subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0505) - An unspecified flaw exists in the Client subcomponent that allows a local attacker to gain elevated privileges. (CVE-2016-0546) - An unspecified flaw exists in the Server : DML subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0596) - Multiple unspecified flaws exist in the Server : Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616) - An unspecified flaw exists in the Server : InnoDB subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0600) - An unspecified flaw exists in the Server : Security : Encryption subcomponent that allows an authenticated, remote attacker to impact integrity. (CVE-2016-0606, CVE-2016-0609) - An unspecified flaw exists in the Server : UDF subcomponent that allows an authenticated, remote attacker to cause a denial of service. (CVE-2016-0608) - An unspecified flaw exists in the Optimizer subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-0651) - A denial of service vulnerability exists due to repeatedly executing a prepared statement when the default database has been changed. An authenticated, remote attacker can exploit this to cause the server to exit. - A denial of service vulnerability exists that is triggered when updating views using ALL comparison operators on subqueries that select from indexed columns in the main table. An authenticated, remote attacker can exploit this to cause the server to exit, resulting in a denial of service condition. - A remote code execution vulnerability exists due to improper validation of user-supplied input to the strcpy() and sprintf() functions. An authenticated, remote attacker can exploit this to cause a buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. - A denial of service vulnerability exists that is triggered when handling concurrent FLUSH PRIVILEGES and REVOKE or GRANT statements. An authenticated, remote attacker can exploit this to cause the server to exit by triggering an invalid memory access to proxy user information. - A denial of service vulnerability exists that is triggered on the second execution of a prepared statement where an ORDER BY clause references a column position. An authenticated, remote attacker can exploit this to cause the server to exit.
    last seen2020-06-01
    modified2020-06-02
    plugin id87419
    published2015-12-16
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87419
    titleMySQL 5.5.x < 5.5.47 Multiple Vulnerabilities

Redhat

advisories
  • rhsa
    idRHSA-2016:0534
  • rhsa
    idRHSA-2016:0705
  • rhsa
    idRHSA-2016:1132
  • rhsa
    idRHSA-2016:1480
  • rhsa
    idRHSA-2016:1481
rpms
  • mariadb-1:5.5.47-1.el7_2
  • mariadb-bench-1:5.5.47-1.el7_2
  • mariadb-debuginfo-1:5.5.47-1.el7_2
  • mariadb-devel-1:5.5.47-1.el7_2
  • mariadb-embedded-1:5.5.47-1.el7_2
  • mariadb-embedded-devel-1:5.5.47-1.el7_2
  • mariadb-libs-1:5.5.47-1.el7_2
  • mariadb-server-1:5.5.47-1.el7_2
  • mariadb-test-1:5.5.47-1.el7_2
  • rh-mysql56-mysql-0:5.6.30-1.el6
  • rh-mysql56-mysql-0:5.6.30-1.el7
  • rh-mysql56-mysql-bench-0:5.6.30-1.el6
  • rh-mysql56-mysql-bench-0:5.6.30-1.el7
  • rh-mysql56-mysql-common-0:5.6.30-1.el6
  • rh-mysql56-mysql-common-0:5.6.30-1.el7
  • rh-mysql56-mysql-config-0:5.6.30-1.el6
  • rh-mysql56-mysql-config-0:5.6.30-1.el7
  • rh-mysql56-mysql-debuginfo-0:5.6.30-1.el6
  • rh-mysql56-mysql-debuginfo-0:5.6.30-1.el7
  • rh-mysql56-mysql-devel-0:5.6.30-1.el6
  • rh-mysql56-mysql-devel-0:5.6.30-1.el7
  • rh-mysql56-mysql-errmsg-0:5.6.30-1.el6
  • rh-mysql56-mysql-errmsg-0:5.6.30-1.el7
  • rh-mysql56-mysql-server-0:5.6.30-1.el6
  • rh-mysql56-mysql-server-0:5.6.30-1.el7
  • rh-mysql56-mysql-test-0:5.6.30-1.el6
  • rh-mysql56-mysql-test-0:5.6.30-1.el7
  • rh-mariadb100-mariadb-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-bench-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-bench-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-common-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-common-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-config-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-config-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-debuginfo-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-debuginfo-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-devel-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-devel-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-errmsg-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-errmsg-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-oqgraph-engine-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-oqgraph-engine-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-server-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-server-1:10.0.25-4.el7
  • rh-mariadb100-mariadb-test-1:10.0.25-4.el6
  • rh-mariadb100-mariadb-test-1:10.0.25-4.el7
  • mysql55-mysql-0:5.5.50-1.el6
  • mysql55-mysql-0:5.5.50-1.el7
  • mysql55-mysql-bench-0:5.5.50-1.el6
  • mysql55-mysql-bench-0:5.5.50-1.el7
  • mysql55-mysql-debuginfo-0:5.5.50-1.el6
  • mysql55-mysql-debuginfo-0:5.5.50-1.el7
  • mysql55-mysql-devel-0:5.5.50-1.el6
  • mysql55-mysql-devel-0:5.5.50-1.el7
  • mysql55-mysql-libs-0:5.5.50-1.el6
  • mysql55-mysql-libs-0:5.5.50-1.el7
  • mysql55-mysql-server-0:5.5.50-1.el6
  • mysql55-mysql-server-0:5.5.50-1.el7
  • mysql55-mysql-test-0:5.5.50-1.el6
  • mysql55-mysql-test-0:5.5.50-1.el7
  • mariadb55-mariadb-0:5.5.49-1.el6
  • mariadb55-mariadb-0:5.5.49-1.el7
  • mariadb55-mariadb-bench-0:5.5.49-1.el6
  • mariadb55-mariadb-bench-0:5.5.49-1.el7
  • mariadb55-mariadb-debuginfo-0:5.5.49-1.el6
  • mariadb55-mariadb-debuginfo-0:5.5.49-1.el7
  • mariadb55-mariadb-devel-0:5.5.49-1.el6
  • mariadb55-mariadb-devel-0:5.5.49-1.el7
  • mariadb55-mariadb-libs-0:5.5.49-1.el6
  • mariadb55-mariadb-libs-0:5.5.49-1.el7
  • mariadb55-mariadb-server-0:5.5.49-1.el6
  • mariadb55-mariadb-server-0:5.5.49-1.el7
  • mariadb55-mariadb-test-0:5.5.49-1.el6
  • mariadb55-mariadb-test-0:5.5.49-1.el7