Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Aug 30, 2017 | Sep 20, 2016 |
| Amazon_linux | — | Upgrade mysql56Upgrade mysql55Upgrade mysql51 | Oct 13, 2016 | Sep 20, 2016 |
| Centos_linux | — | Upgrade mysql-develUpgrade mysql-serverUpgrade mysql-testUpgrade mysqlUpgrade mysql-embeddedUpgrade mysql-benchUpgrade mysql-libsUpgrade mysql-embedded-develUpgrade mysql-debuginfo | Jul 1, 2017 | Sep 20, 2016 |
| Debian | — | Upgrade mariadb-10.0Upgrade mysql-5.5 | Mar 31, 2017 | Sep 14, 2016 |
| Freebsd | — | Upgrade mysql55-serverUpgrade mysql57-serverUpgrade mysql56-serverUpgrade mariadb100-serverUpgrade mariadb55-serverUpgrade mysql57-clientUpgrade mariadb101-serverUpgrade percona56-serverUpgrade percona55-serverUpgrade percona57-server | Nov 14, 2016 | Sep 14, 2016 |
| Gentoo Linux | — | Upgrade dev-db/mysql.Upgrade dev-db/mariadb. | Oct 30, 2017 | Sep 20, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade mariadb-benchUpgrade mariadb-develUpgrade mariadb-libsUpgrade mariadb-serverUpgrade mariadb-testUpgrade mariadbUpgrade mariadb-embedded | Nov 30, 2017 | Sep 20, 2016 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Sep 20, 2016 |
| Oracle Mysql | — | Upgrade to Oracle MySQL version 5.5.51Upgrade to Oracle MySQL version 5.7.14Upgrade to Oracle MySQL version 5.6.32 | Sep 23, 2016 | Sep 20, 2016 |
| Oracle Solaris | — | Upgrade database/mysql-55/library to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/library to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-56/tests to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/client to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-55/tests to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade runtime/perl-threaded-512 to version 5.12.5-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-56 to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-56/library to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/embedded to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-56/client to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade runtime/perl-512 to version 5.12.5-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-57/tests to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-55/client to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-55 to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57 to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3 | May 29, 2017 | Sep 20, 2016 |
| Oracle_linux | — | Upgrade mariadb-libsUpgrade mysql-libsUpgrade mysql-embedded-develUpgrade mysqlUpgrade mariadb-embedded-develUpgrade mariadb-testUpgrade mysql-develUpgrade mariadb-benchUpgrade mysql-benchUpgrade mariadb-serverUpgrade mysql-testUpgrade mariadbUpgrade mysql-embeddedUpgrade mariadb-embeddedUpgrade mariadb-develUpgrade mysql-server | Nov 9, 2016 | Sep 12, 2016 |
| Redhat_linux | — | Upgrade mysqlNo solution existsUpgrade mysql-debuginfoUpgrade mysql-testUpgrade mysql-embedded-develUpgrade mysql-benchUpgrade mysql-libsUpgrade mysql-develUpgrade mysql-serverUpgrade mysql-embedded | Nov 4, 2016 | Sep 20, 2016 |
| Suse | — | Upgrade mysql-clientUpgrade mysqlUpgrade libmysqlclient-develUpgrade libmysqlclient_r18Upgrade libmysql55client_r18Upgrade libmysqld-develUpgrade libmysqld18Upgrade mariadb-toolsUpgrade mariadb-100-errormessagesUpgrade mysql-toolsUpgrade libmysqlclient_r18-32bitUpgrade libmysqlclient18-32bitUpgrade libmysql55client18-x86Upgrade libmysql55client_r18-x86Upgrade libmysqld19Upgrade mariadb-errormessagesUpgrade mariadbUpgrade libmysql55client18-32bitUpgrade libmariadbd19Upgrade libmysql55client_r18-32bitUpgrade mariadb-clientUpgrade libmariadbd-develUpgrade libmysqlclient18Upgrade libmysql55client18 | Sep 21, 2016 | Sep 20, 2016 |
| Ubuntu | — | Upgrade mysql-server-5.5Upgrade mysql-server-5.7 | Jul 1, 2017 | Sep 13, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub