mysql-community-server was updated to 5.6.34 to fix the following issues :

  - Changes     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     34.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     33.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     32.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     31.html

  - fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440,     CVE-2016-5584, CVE-2016-5617, CVE-2016-5616,     CVE-2016-5626, CVE-2016-3492, CVE-2016-5629,     CVE-2016-5507, CVE-2016-8283, CVE-2016-5609,     CVE-2016-5612, CVE-2016-5627, CVE-2016-5630,     CVE-2016-8284, CVE-2016-8288, CVE-2016-3477,     CVE-2016-2105, CVE-2016-3486, CVE-2016-3501,     CVE-2016-3521, CVE-2016-3615, CVE-2016-3614,     CVE-2016-3459, CVE-2016-5439, CVE-2016-5440

  - fixes SUSE Bugs: [boo#999666], [boo#998309],     [boo#1005581], [boo#1005558], [boo#1005563],     [boo#1005562], [boo#1005566], [boo#1005555],     [boo#1005569], [boo#1005557], [boo#1005582],     [boo#1005560], [boo#1005561], [boo#1005567],     [boo#1005570], [boo#1005583], [boo#1005586],     [boo#989913], [boo#977614], [boo#989914], [boo#989915],     [boo#989919], [boo#989922], [boo#989921], [boo#989911],     [boo#989925], [boo#989926]

  - append '--ignore-db-dir=lost+found' to the mysqld     options in 'mysql-systemd-helper' script if 'lost+found'     directory is found in $datadir [boo#986251] 

  - remove syslog.target from *.service files [boo#983938]

  - add systemd to deps to build on leap and friends 

  - replace '%(_libexecdir)/systemd/system' with %(_unitdir)     macro

  - remove useless mysql@default.service [boo#971456]

  - replace all occurrences of the string '@sysconfdir@'     with '/etc' in     mysql-community-server-5.6.3-logrotate.patch as it     wasn't expanded properly [boo#990890]

  - remove '%define _rundir' as 13.1 is out of support scope

  - run 'usermod -g mysql mysql' only if mysql user is not     in mysql group. Run 'usermod -s /bin/false/ mysql' only     if mysql user doesn't have '/bin/false' shell set.

  - re-enable mysql profiling

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-715:03 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a     client/server implementation consisting of a server daemon (mysqld)     and many different client programs and libraries. The base package     contains the standard MySQL client programs and generic MySQL files.
    Security issues fixed with this release:
    CVE-2016-3492     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote authenticated users     to affect availability via vectors related to Server: Optimizer.
    CVE-2016-5612     Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31     and earlier, and 5.7.13 and earlier allows remote authenticated users     to affect availability via vectors related to DML.
    CVE-2016-5616     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows local users to affect     confidentiality, integrity, and availability via vectors related to     Server: MyISAM.
    CVE-2016-5617     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows local users to affect     confidentiality, integrity, and availability via vectors related to     Server: Error Handling.
    CVE-2016-5624     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows     remote authenticated users to affect availability via vectors related     to DML.
    CVE-2016-5626     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote authenticated users     to affect availability via vectors related to GIS.
    CVE-2016-5629     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote administrators to     affect availability via vectors related to Server: Federated.
    CVE-2016-6662     Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through     5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x     before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before     5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create     arbitrary configurations and bypass certain protection mechanisms by     setting general_log_file to a my.cnf configuration.  NOTE: this can be     leveraged to execute arbitrary code with root privileges by setting     malloc_lib.
    CVE-2016-8283     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote authenticated users     to affect availability via vectors related to Server: Types.
    The following packages have been upgraded to a newer upstream version: mysql55-mysql (5.5.52).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.32. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5612)

  - Multiple unspecified flaws exist in the InnoDB     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5627, CVE-2016-5630)

  - An unspecified flaw exists in the Replication     subcomponent that allows a local attacker to cause a     denial of service condition. (CVE-2016-8284)

  - A denial of service vulnerability exists in the     NAME_CONST() function when handling certain unspecified     arguments. An authenticated, remote attacker can exploit     this to cause the server to exit.

  - A denial of service vulnerability exists in InnoDB when     selecting full-text index information schema tables for     a deleted table. An authenticated, remote attacker can     exploit this to cause a segmentation fault.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier     allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-5612)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of MariaDB installed on the remote host is prior to 10.0.27. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.27 advisory.

  - Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x     before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before     5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass     certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be     leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL     version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that     the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15. (CVE-2016-6662)

  - Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier     allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-5612)

  - Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote     administrators to affect availability via vectors related to Server: InnoDB. (CVE-2016-5630)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.14. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws exist in the InnoDB     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-3495, CVE-2016-5627, CVE-2016-5630)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5612)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5628)

  - An unspecified flaw exists in the Memcached     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5631)

  - Multiple unspecified flaws exist in the Performance     Schema subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5633, CVE-2016-8290)

  - An unspecified flaw exists in the RBR subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5634)

  - An unspecified flaw exists in the Security: Audit     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5635)

  - An unspecified flaw exists in the Replication     subcomponent that allows a local attacker to cause a     denial of service condition. (CVE-2016-8284)

  - An unspecified flaw exists in the Replication     subcomponent that allows a authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-8287)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows a local attacker to impact integrity and     availability. (CVE-2016-8289)

  - A denial of service vulnerability exists in InnoDB when     selecting full-text index information schema tables for     a deleted table. An authenticated, remote attacker can     exploit this to cause a segmentation fault.

  - A denial of service vulnerability exists in InnoDB when     handling ALTER TABLE operations on tables that have an     indexed virtual column. An authenticated, remote     attacker can exploit this to cause an assertion failure,     resulting in a server crash.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
94694	openSUSE Security Update : mysql-community-server (openSUSE-2016-1283)	Nessus	SuSE Local Security Checks	2016/11/11	2026/1/19	critical
289853	MiracleLinux 4 : mysql55-mysql-5.5.52-1.AXS4 (AXSA:2016-715:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
93003	MySQL 5.6.x < 5.6.32 Multiple Vulnerabilities	Nessus	Databases	2016/8/17	2026/1/28	medium
219623	Linux Distros Unpatched Vulnerability : CVE-2016-5612	Nessus	Misc.	2025/3/4	2026/11/5	medium
93609	MariaDB 10.0.0 < 10.0.27 Multiple Vulnerabilities	Nessus	Databases	2016/9/20	2026/1/29	critical
93002	MySQL 5.6.x < 5.6.32 Multiple Vulnerabilities	Nessus	Databases	2016/8/17	2026/1/28	medium
93005	MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities	Nessus	Databases	2016/8/17	2026/1/28	medium

検出

プラグインの検索

critical

critical

medium

medium

critical

medium

medium