Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table. (CVE-2016-6663)

Security Fix(es) :

  - It was discovered that the MySQL logging functionality     allowed writing to MySQL configuration files. An     administrative database user, or a database user with     FILE privileges, could possibly use this flaw to run     arbitrary commands with root privileges on the system     running the database server. (CVE-2016-6662)

  - A race condition was found in the way MySQL performed     MyISAM engine table repair. A database user with shell     access to the server running mysqld could use this flaw     to change permissions of arbitrary files writable by the     mysql system user. (CVE-2016-6663, CVE-2016-5616)

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2017:0184 advisory.

  - Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x     before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before     5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass     certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be     leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL     version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that     the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15. (CVE-2016-6662)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-6663. Reason: This candidate is a     reservation duplicate of CVE-2016-6663. Notes: All CVE users should reference CVE-2016-6663 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage (CVE-2016-5616)

  - Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before     8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before     5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before     5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain     permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
    (CVE-2016-6663)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.33. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5507)

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - An unspecified flaw exists that allows an authenticated,     remote attacker to bypass restrictions and create the     /var/lib/mysql/my.cnf file with custom contents without     the FILE privilege requirement. (CVE-2016-6663)     
  - A flaw exists that is related to the use of temporary     files by REPAIR TABLE. An authenticated, remote attacker     can exploit this to gain elevated privileges.

  - A flaw exists in InnoDB when handling an operation that     dropped and created a full-text search table. An     authenticated, remote attacker can exploit this to     trigger an assertion, resulting in a denial of service     condition.

  - A flaw exists in InnoDB when accessing full-text     auxiliary tables while dropping the indexed table. An     authenticated, remote attacker can exploit this to     trigger an assertion, resulting in a denial of service     condition.

  - A buffer overflow condition exists when handling long     integer values in MEDIUMINT columns due to the improper     validation of certain input. An authenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.

  - An unspecified flaw exists due to how a prepared     statement uses a parameter in the select list of a     derived table that was part of a join. An authenticated,     remote attacker can exploit this to cause a server exit,     resulting in a denial of service condition.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.15. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws exist in the Optimizer     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-3492, CVE-2016-5632)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5507)

  - An unspecified flaw exists in the MyISAM subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-5616)

  - An unspecified flaw exists in the Error Handling     subcomponent that allows a local attacker to gain     elevated privileges. (CVE-2016-5617)

  - An unspecified flaw exists in the Packaging subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-5625)

  - An unspecified flaw exists in the GIS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5626)

  - An unspecified flaw exists in the Federated subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5629)

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - An unspecified flaw exists that allows an authenticated,     remote attacker to bypass restrictions and create the     /var/lib/mysql/my.cnf file with custom contents without     the FILE privilege requirement. (CVE-2016-6663)     
  - An unspecified flaw exists in the Types subcomponent     that allows an authenticated, remote attacker to cause     a denial of service condition.(CVE-2016-8283)

  - An unspecified flaw exists in the Security: Privileges     subcomponent that allows an authenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-8286)

  - A flaw exists that is related to the use of temporary     files by REPAIR TABLE. An authenticated, remote attacker     can exploit this to gain elevated privileges.

  - A flaw exists in InnoDB when handling an operation that     dropped and created a full-text search table. An     authenticated, remote attacker can exploit this to     trigger an assertion, resulting in a denial of service     condition.

  - A flaw exists in InnoDB when accessing full-text     auxiliary tables while dropping the indexed table. An     authenticated, remote attacker can exploit this to     trigger an assertion, resulting in a denial of service     condition.

  - A buffer overflow condition exists when handling long     integer values in MEDIUMINT columns due to the improper     validation of certain input. An authenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.

  - An information disclosure vulnerability exists in the     validate_password plugin due to passwords that have been     rejected being written as plaintext to the error log. A     local attacker can exploit this to more easily guess     what passwords might have been chosen and accepted.

  - A flaw exists in InnoDB when handling an ALTER TABLE ...
    ENCRYPTION='Y', ALGORITHM=COPY operation that is applied     to a table in the system tablespace. An authenticated,     remote attacker can exploit this to trigger an     assertion, resulting in a denial of service condition.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This mariadb update to version 10.0.28 fixes the following issues (bsc#1008318): Security fixes :

  - CVE-2016-8283: Unspecified vulnerability in subcomponent     Types (bsc#1005582)

  - CVE-2016-7440: Unspecified vulnerability in subcomponent     Encryption (bsc#1005581)

  - CVE-2016-5629: Unspecified vulnerability in subcomponent     Federated (bsc#1005569)

  - CVE-2016-5626: Unspecified vulnerability in subcomponent     GIS (bsc#1005566)

  - CVE-2016-5624: Unspecified vulnerability in subcomponent     DML (bsc#1005564)

  - CVE-2016-5616: Unspecified vulnerability in subcomponent     MyISAM (bsc#1005562)

  - CVE-2016-5584: Unspecified vulnerability in subcomponent     Encryption (bsc#1005558)

  - CVE-2016-3492: Unspecified vulnerability in subcomponent     Optimizer (bsc#1005555)

  - CVE-2016-6663: Privilege Escalation / Race Condition     (bsc#1001367) Bugfixes :

  - mysql_install_db can't find data files (bsc#1006539)

  - mariadb failing test sys_vars.optimizer_switch_basic     (bsc#1003800)

  - Notable changes :

  - XtraDB updated to 5.6.33-79.0

  - TokuDB updated to 5.6.33-79.0

  - Innodb updated to 5.6.33

  - Performance Schema updated to 5.6.33

  - Release notes and upstream changelog :

  - https://kb.askmonty.org/en/mariadb-10028-release-notes

  - https://kb.askmonty.org/en/mariadb-10028-changelog

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This mariadb update to version 10.0.28 fixes the following issues (bsc#1008318): Security fixes :

  - CVE-2016-8283: Unspecified vulnerability in subcomponent     Types (bsc#1005582)

  - CVE-2016-7440: Unspecified vulnerability in subcomponent     Encryption (bsc#1005581)

  - CVE-2016-5629: Unspecified vulnerability in subcomponent     Federated (bsc#1005569)

  - CVE-2016-5626: Unspecified vulnerability in subcomponent     GIS (bsc#1005566)

  - CVE-2016-5624: Unspecified vulnerability in subcomponent     DML (bsc#1005564)

  - CVE-2016-5616: Unspecified vulnerability in subcomponent     MyISAM (bsc#1005562)

  - CVE-2016-5584: Unspecified vulnerability in subcomponent     Encryption (bsc#1005558)

  - CVE-2016-3492: Unspecified vulnerability in subcomponent     Optimizer (bsc#1005555)

  - CVE-2016-6663: Privilege Escalation / Race Condition     (bsc#1001367) Bugfixes :

  - mysql_install_db can't find data files (bsc#1006539)

  - mariadb failing test sys_vars.optimizer_switch_basic     (bsc#1003800)

  - Remove useless mysql@default.service (bsc#1004477)

  - Replace all occurrences of the string '@sysconfdir@'     with '/etc' as it wasn't expanded properly (bsc#990890)

  - Notable changes :

  - XtraDB updated to 5.6.33-79.0

  - TokuDB updated to 5.6.33-79.0

  - Innodb updated to 5.6.33

  - Performance Schema updated to 5.6.33

  - Release notes and upstream changelog :

  - https://kb.askmonty.org/en/mariadb-10028-release-notes

  - https://kb.askmonty.org/en/mariadb-10028-changelog

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-932:03 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a     client/server implementation consisting of a server daemon (mysqld)     and many different client programs and libraries. The base package     contains the standard MySQL client programs and generic MySQL files.
    Security issues fixed with this release:
    CVE-2016-3492     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote authenticated users     to affect availability via vectors related to Server: Optimizer.
    CVE-2016-5507     Unspecified vulnerability in Oracle MySQL 5.6.32 and earlier and     5.7.14 and earlier allows remote administrators to affect availability     via vectors related to Server: InnoDB.
    CVE-2016-5616     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows local users to affect     confidentiality, integrity, and availability via vectors related to     Server: MyISAM.
    CVE-2016-5617     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows local users to affect     confidentiality, integrity, and availability via vectors related to     Server: Error Handling.
    CVE-2016-5626     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote authenticated users     to affect availability via vectors related to GIS.
    CVE-2016-5629     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote administrators to     affect availability via vectors related to Server: Federated.
    CVE-2016-6662     Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through     5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x     before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before     5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create     arbitrary configurations and bypass certain protection mechanisms by     setting general_log_file to a my.cnf configuration.  NOTE: this can be     leveraged to execute arbitrary code with root privileges by setting     malloc_lib.
    CVE-2016-6663
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-6664
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-8283     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote authenticated users     to affect availability via vectors related to Server: Types.
    The following packages have been upgraded to a newer upstream version: rh-mysql56-mysql (5.6.34).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
112023	F5 Networks BIG-IP : MySQL vulnerability (K73828041)	Nessus	F5 Networks Local Security Checks	2018/8/21	2025/3/26	high
96758	Scientific Linux Security Update : mysql on SL6.x i386/x86_64 (20170124)	Nessus	Scientific Linux Local Security Checks	2017/1/25	2026/1/2	critical
96812	CentOS 6 : mysql (CESA-2017:0184)	Nessus	CentOS Local Security Checks	2017/1/27	2025/9/26	critical
93377	MySQL 5.6.x < 5.6.33 Multiple Vulnerabilities	Nessus	Databases	2016/9/8	2019/11/14	critical
93380	MySQL 5.7.x < 5.7.15 Multiple Vulnerabilities	Nessus	Databases	2016/9/8	2020/6/3	critical
95383	SUSE SLES12 Security Update : mariadb (SUSE-SU-2016:2932-1)	Nessus	SuSE Local Security Checks	2016/11/29	2026/1/16	high
95384	SUSE SLED12 / SLES12 Security Update : Recommended update for mariadb (SUSE-SU-2016:2933-1)	Nessus	SuSE Local Security Checks	2016/11/29	2026/1/16	high
289876	MiracleLinux 7 : rh-mysql56-mysql-5.6.34-2.el7 (AXSA:2016-932:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/9	critical

検出

プラグインの検索

high

critical

critical

critical

critical

high

high

critical