Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Aug 30, 2017 | Sep 20, 2016 |
| Amazon_linux | — | Upgrade mysql51Upgrade mysql55Upgrade mysql56 | Oct 13, 2016 | Sep 20, 2016 |
| Centos_linux | — | Upgrade mysql-debuginfoUpgrade mysql-embedded-develUpgrade mysql-libsUpgrade mysql-testUpgrade mysql-embeddedUpgrade mysqlUpgrade mysql-benchUpgrade mysql-develUpgrade mysql-server | Jul 1, 2017 | Sep 20, 2016 |
| Debian | — | Upgrade mysql-5.5Upgrade mariadb-10.0 | Mar 31, 2017 | Sep 14, 2016 |
| Freebsd | — | Upgrade mysql55-serverUpgrade mariadb100-serverUpgrade mysql56-serverUpgrade mysql57-serverUpgrade mariadb55-serverUpgrade percona56-serverUpgrade percona57-serverUpgrade mysql57-clientUpgrade mariadb101-serverUpgrade percona55-server | Nov 14, 2016 | Sep 14, 2016 |
| Gentoo Linux | — | Upgrade dev-db/mariadb.Upgrade dev-db/mysql. | Oct 30, 2017 | Sep 20, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade mariadb-develUpgrade mariadb-serverUpgrade mariadb-benchUpgrade mariadb-libsUpgrade mariadb-embeddedUpgrade mariadb-testUpgrade mariadb | Nov 30, 2017 | Sep 20, 2016 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Sep 20, 2016 |
| Oracle Mysql | — | Upgrade to Oracle MySQL version 5.7.14Upgrade to Oracle MySQL version 5.5.51Upgrade to Oracle MySQL version 5.6.32 | Sep 23, 2016 | Sep 20, 2016 |
| Oracle Solaris | — | Upgrade database/mysql-56/tests to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/library to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-55/library to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/client to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-55/tests to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-55/client to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-56/client to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-56/library to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade runtime/perl-threaded-512 to version 5.12.5-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-56 to version 5.6.37-0.175.3.25.0.1.0 on Solaris 11.3Upgrade runtime/perl-512 to version 5.12.5-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-57 to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-55 to version 5.5.57-0.175.3.25.0.1.0 on Solaris 11.3Upgrade database/mysql-57/tests to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3Upgrade database/mysql-57/embedded to version 5.7.17-0.175.3.19.0.2.0 on Solaris 11.3 | May 29, 2017 | Sep 20, 2016 |
| Oracle_linux | — | Upgrade mysql-embedded-develUpgrade mariadb-embedded-develUpgrade mariadb-libsUpgrade mysql-libsUpgrade mariadb-testUpgrade mysqlUpgrade mariadb-embeddedUpgrade mariadb-develUpgrade mysql-serverUpgrade mysql-develUpgrade mariadbUpgrade mysql-benchUpgrade mariadb-serverUpgrade mysql-testUpgrade mariadb-benchUpgrade mysql-embedded | Nov 9, 2016 | Sep 12, 2016 |
| Redhat_linux | — | Upgrade mysql-develUpgrade mysql-libsUpgrade mysql-embeddedUpgrade mysql-serverUpgrade mysql-debuginfoUpgrade mysql-testUpgrade mysqlNo solution existsUpgrade mysql-benchUpgrade mysql-embedded-devel | Nov 4, 2016 | Sep 20, 2016 |
| Suse | — | Upgrade libmysqlclient18Upgrade libmariadbd19Upgrade mariadb-clientUpgrade mariadbUpgrade libmysql55client18Upgrade libmysql55client18-32bitUpgrade libmysql55client_r18-32bitUpgrade libmariadbd-develUpgrade libmysql55client18-x86Upgrade mariadb-errormessagesUpgrade libmysqld19Upgrade libmysql55client_r18-x86Upgrade mariadb-toolsUpgrade mysql-toolsUpgrade libmysqlclient_r18-32bitUpgrade libmysqlclient-develUpgrade libmysqlclient18-32bitUpgrade mysqlUpgrade mariadb-100-errormessagesUpgrade libmysql55client_r18Upgrade libmysqld-develUpgrade libmysqld18Upgrade libmysqlclient_r18Upgrade mysql-client | Sep 21, 2016 | Sep 20, 2016 |
| Ubuntu | — | Upgrade mysql-server-5.7Upgrade mysql-server-5.5 | Jul 1, 2017 | Sep 13, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub