Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Aug 30, 2017 | Sep 20, 2016 |
| Amazon_linux | — | Upgrade mysql51Upgrade mysql56Upgrade mysql55 | Oct 13, 2016 | Sep 20, 2016 |
| Centos_linux | — | Upgrade mysql-debuginfoUpgrade mysql-embedded-develUpgrade mysql-libsUpgrade mysqlUpgrade mysql-embeddedUpgrade mysql-develUpgrade mysql-serverUpgrade mysql-testUpgrade mysql-bench | Jul 1, 2017 | Sep 20, 2016 |
| Debian | — | Upgrade mariadb-10.0Upgrade mysql-5.5 | Mar 31, 2017 | Sep 14, 2016 |
| Freebsd | — | Upgrade mariadb100-serverUpgrade mysql56-serverUpgrade mysql55-serverUpgrade mariadb55-serverUpgrade mysql57-serverUpgrade percona56-serverUpgrade mariadb101-serverUpgrade mysql57-clientUpgrade percona57-serverUpgrade percona55-server | Nov 14, 2016 | Sep 14, 2016 |
| Gentoo Linux | — | Upgrade dev-db/mysql.Upgrade dev-db/mariadb. | Oct 30, 2017 | Sep 20, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade mariadbUpgrade mariadb-testUpgrade mariadb-embeddedUpgrade mariadb-benchUpgrade mariadb-develUpgrade mariadb-libsUpgrade mariadb-server | Nov 30, 2017 | Sep 20, 2016 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Sep 20, 2016 |
| Oracle Mysql | — | Upgrade to Oracle MySQL version 5.6.32Upgrade to Oracle MySQL version 5.5.51Upgrade to Oracle MySQL version 5.7.14 | Sep 23, 2016 | Sep 20, 2016 |
| Oracle Solaris | — | Upgrade database/mysql-55/library to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-56/tests to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/client to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-57/library to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-57 to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-55/client to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-56/client to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade runtime/perl-threaded-512 to version 5.12.5-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-57/tests to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-56/library to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-55 to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/embedded to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-55/tests to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-56 to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade runtime/perl-512 to version 5.12.5-0.175.3.19.0.2.0 on Solaris 11.3 | May 29, 2017 | Sep 20, 2016 |
| Oracle_linux | — | Upgrade mysql-embedded-develUpgrade mysqlUpgrade mysql-libsUpgrade mariadb-testUpgrade mariadb-libsUpgrade mariadb-embedded-develUpgrade mysql-develUpgrade mysql-embeddedUpgrade mariadb-embeddedUpgrade mariadb-develUpgrade mysql-benchUpgrade mariadb-benchUpgrade mysql-serverUpgrade mariadbUpgrade mariadb-serverUpgrade mysql-test | Nov 9, 2016 | Sep 12, 2016 |
| Redhat_linux | — | Upgrade mysql-benchUpgrade mysql-testUpgrade mysql-embedded-develUpgrade mysqlUpgrade mysql-debuginfoNo solution existsUpgrade mysql-develUpgrade mysql-embeddedUpgrade mysql-serverUpgrade mysql-libs | Nov 4, 2016 | Sep 20, 2016 |
| Suse | — | Upgrade libmysql55client_r18Upgrade libmysqlclient_r18-32bitUpgrade libmysqlclient18-32bitUpgrade libmysqlclient-develUpgrade mysql-toolsUpgrade mysql-clientUpgrade libmysqld18Upgrade mariadb-100-errormessagesUpgrade libmysqlclient_r18Upgrade mysqlUpgrade mariadb-toolsUpgrade libmysqld-develUpgrade libmariadbd19Upgrade mariadb-clientUpgrade libmysql55client18-32bitUpgrade libmysql55client_r18-32bitUpgrade libmariadbd-develUpgrade libmysql55client18-x86Upgrade mariadbUpgrade libmysqld19Upgrade libmysql55client_r18-x86Upgrade libmysql55client18Upgrade mariadb-errormessagesUpgrade libmysqlclient18 | Sep 21, 2016 | Sep 20, 2016 |
| Ubuntu | — | Upgrade mysql-server-5.7Upgrade mysql-server-5.5 | Jul 1, 2017 | Sep 13, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub