Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Aug 30, 2017 | Sep 20, 2016 |
| Amazon_linux | — | Upgrade mysql55Upgrade mysql51Upgrade mysql56 | Oct 13, 2016 | Sep 20, 2016 |
| Centos_linux | — | Upgrade mysql-embeddedUpgrade mysqlUpgrade mysql-benchUpgrade mysql-serverUpgrade mysql-testUpgrade mysql-develUpgrade mysql-libsUpgrade mysql-debuginfoUpgrade mysql-embedded-devel | Jul 1, 2017 | Sep 20, 2016 |
| Debian | — | Upgrade mysql-5.5Upgrade mariadb-10.0 | Mar 31, 2017 | Sep 14, 2016 |
| Freebsd | — | Upgrade mariadb55-serverUpgrade mariadb100-serverUpgrade mysql57-serverUpgrade mysql56-serverUpgrade mysql55-serverUpgrade percona55-serverUpgrade mysql57-clientUpgrade mariadb101-serverUpgrade percona56-serverUpgrade percona57-server | Nov 14, 2016 | Sep 14, 2016 |
| Gentoo Linux | — | Upgrade dev-db/mysql.Upgrade dev-db/mariadb. | Oct 30, 2017 | Sep 20, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade mariadb-develUpgrade mariadb-libsUpgrade mariadb-serverUpgrade mariadb-benchUpgrade mariadbUpgrade mariadb-testUpgrade mariadb-embedded | Nov 30, 2017 | Sep 20, 2016 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Sep 20, 2016 |
| Oracle Mysql | — | Upgrade to Oracle MySQL version 5.6.32Upgrade to Oracle MySQL version 5.5.51Upgrade to Oracle MySQL version 5.7.14 | Sep 23, 2016 | Sep 20, 2016 |
| Oracle Solaris | — | Upgrade database/mysql-57/tests to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-56/client to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-55/tests to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-55/client to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/embedded to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade runtime/perl-512 to version 5.12.5-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-55 to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57 to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-56/library to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade runtime/perl-threaded-512 to version 5.12.5-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-56 to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-55/library to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/client to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-57/library to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-56/tests to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3 | May 29, 2017 | Sep 20, 2016 |
| Oracle_linux | — | Upgrade mysql-embeddedUpgrade mysql-testUpgrade mariadb-embeddedUpgrade mysql-serverUpgrade mysql-benchUpgrade mariadb-serverUpgrade mariadb-benchUpgrade mysql-develUpgrade mariadb-develUpgrade mariadbUpgrade mariadb-libsUpgrade mariadb-testUpgrade mysqlUpgrade mysql-libsUpgrade mysql-embedded-develUpgrade mariadb-embedded-devel | Nov 9, 2016 | Sep 12, 2016 |
| Redhat_linux | — | Upgrade mysql-embedded-develUpgrade mysqlUpgrade mysql-benchUpgrade mysql-testUpgrade mysql-debuginfoNo solution existsUpgrade mysql-serverUpgrade mysql-embeddedUpgrade mysql-develUpgrade mysql-libs | Nov 4, 2016 | Sep 20, 2016 |
| Suse | — | Upgrade libmariadbd-develUpgrade libmysql55client_r18-32bitUpgrade libmysql55client18-32bitUpgrade mariadbUpgrade libmariadbd19Upgrade libmysqld19Upgrade libmysqlclient18Upgrade mariadb-clientUpgrade libmysql55client18-x86Upgrade libmysql55client18Upgrade libmysql55client_r18-x86Upgrade mariadb-errormessagesUpgrade libmysql55client_r18Upgrade mysql-toolsUpgrade libmysqlclient_r18Upgrade libmysqlclient_r18-32bitUpgrade libmysqlclient18-32bitUpgrade libmysqld-develUpgrade libmysqld18Upgrade libmysqlclient-develUpgrade mysqlUpgrade mariadb-100-errormessagesUpgrade mysql-clientUpgrade mariadb-tools | Sep 21, 2016 | Sep 20, 2016 |
| Ubuntu | — | Upgrade mysql-server-5.5Upgrade mysql-server-5.7 | Jul 1, 2017 | Sep 13, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub