Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1132 advisory.

  - pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)     (CVE-2015-3210, CVE-2015-8384)

  - pcre: stack overflow caused by mishandled group empty match (8.38/11) (CVE-2015-3217)

  - mysql: unspecified vulnerability related to Server:Partition (CPU October 2015) (CVE-2015-4792,     CVE-2015-4802)

  - mysql: unspecified vulnerability related to Server:DDL (CPU October 2015) (CVE-2015-4815)

  - mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015) (CVE-2015-4816,     CVE-2015-4861, CVE-2015-4895)

  - mysql: unspecified vulnerability related to Client programs (CPU October 2015) (CVE-2015-4819)

  - mysql: unspecified vulnerability related to Server:Types (CPU October 2015) (CVE-2015-4826)

  - mysql: unspecified vulnerability related to Server:Security:Privileges (CPU October 2015) (CVE-2015-4830)

  - mysql: unspecified vulnerability related to Server:SP (CPU October 2015) (CVE-2015-4836)

  - mysql: unspecified vulnerability related to Server:DML (CPU October 2015) (CVE-2015-4858, CVE-2015-4879,     CVE-2015-4913)

  - mysql: unspecified vulnerability related to Server:Parser (CPU October 2015) (CVE-2015-4870)

  - pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis     (8.38/18) (CVE-2015-5073, CVE-2015-8388)

  - pcre: Buffer overflow caused by duplicate named references (8.38/36) (CVE-2015-8381, CVE-2015-8395)

  - pcre: Buffer overflow caused by repeated conditional group (8.38/3) (CVE-2015-8383)

  - pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30)     (CVE-2015-8385)

  - pcre: Buffer overflow caused by lookbehind assertion (8.38/6) (CVE-2015-8386)

  - pcre: inefficient posix character class syntax check (8.38/16) (CVE-2015-8391)

  - pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27) (CVE-2015-8392)

  - mysql: unspecified vulnerability in subcomponent: Server: Options (CPU January 2016) (CVE-2016-0505)

  - mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016) (CVE-2016-0546)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016) (CVE-2016-0596,     CVE-2016-0598)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016) (CVE-2016-0597,     CVE-2016-0616)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016) (CVE-2016-0600,     CVE-2016-0610)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016)     (CVE-2016-0606)

  - mysql: unspecified vulnerability in subcomponent: Server: UDF (CPU January 2016) (CVE-2016-0608)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU January 2016)     (CVE-2016-0609)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU April 2016) (CVE-2016-0640,     CVE-2016-0643, CVE-2016-0646)

  - mysql: unspecified vulnerability in subcomponent: Server: MyISAM (CPU April 2016) (CVE-2016-0641)

  - mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU April 2016) (CVE-2016-0642)

  - mysql: unspecified vulnerability in subcomponent: Server: DDL (CPU April 2016) (CVE-2016-0644)

  - mysql: unspecified vulnerability in subcomponent: Server: FTS (CPU April 2016) (CVE-2016-0647)

  - mysql: unspecified vulnerability in subcomponent: Server: PS (CPU April 2016) (CVE-2016-0648,     CVE-2016-0649)

  - mysql: unspecified vulnerability in subcomponent: Server: Replication (CPU April 2016) (CVE-2016-0650)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016) (CVE-2016-0651)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016) (CVE-2016-0655,     CVE-2016-0668)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU April 2016)     (CVE-2016-0666)

  - pcre: heap buffer overflow in handling of duplicate named groups (8.39/14) (CVE-2016-1283)

  - mysql: ssl-validate-cert incorrect hostname check (CVE-2016-2047)

  - pcre: workspace overflow for (*ACCEPT) with deeply nested parentheses (8.39/13, 10.22/12) (CVE-2016-3191)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU July 2016)     (CVE-2016-3452)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU July 2016) (CVE-2016-3459)

  - mysql: unspecified vulnerability in subcomponent: Server: Option (CPU July 2016) (CVE-2016-3471)

  - mysql: unspecified vulnerability in subcomponent: Server: Connection (CPU July 2016) (CVE-2016-5444)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

mariadb was updated to version 10.0.25 to fix 25 security issues.

These security issues were fixed :

  - CVE-2016-0505: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Options (bsc#980904).

  - CVE-2016-0546: Unspecified vulnerability allowed local     users to affect confidentiality, integrity, and     availability via unknown vectors related to Client     (bsc#980904).

  - CVE-2016-0596: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0597: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0598: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0600: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to InnoDB (bsc#980904).

  - CVE-2016-0606: Unspecified vulnerability allowed remote     authenticated users to affect integrity via unknown     vectors related to encryption (bsc#980904).

  - CVE-2016-0608: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to UDF (bsc#980904).

  - CVE-2016-0609: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to privileges (bsc#980904).

  - CVE-2016-0616: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0640: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0641: Unspecified vulnerability allowed local     users to affect confidentiality and availability via     vectors related to MyISAM (bsc#980904).

  - CVE-2016-0642: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to Federated (bsc#980904).

  - CVE-2016-0643: Unspecified vulnerability allowed local     users to affect confidentiality via vectors related to     DML (bsc#980904).

  - CVE-2016-0644: Unspecified vulnerability allowed local     users to affect availability via vectors related to DDL     (bsc#980904).

  - CVE-2016-0646: Unspecified vulnerability allowed local     users to affect availability via vectors related to DML     (bsc#980904).

  - CVE-2016-0647: Unspecified vulnerability allowed local     users to affect availability via vectors related to FTS     (bsc#980904).

  - CVE-2016-0648: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0649: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0650: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Replication (bsc#980904).

  - CVE-2016-0651: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Optimizer (bsc#980904).

  - CVE-2016-0655: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-0666: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Security: Privileges (bsc#980904).

  - CVE-2016-0668: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-2047: The ssl_verify_server_cert function in     sql-common/client.c did not properly verify that the     server hostname matches a domain name in the subject's     Common Name (CN) or subjectAltName field of the X.509     certificate, which allowed man-in-the-middle attackers     to spoof SSL servers via a '/CN=' string in a field in a     certificate, as demonstrated by     '/OU=/CN=bar.com/CN=foo.com (bsc#963806).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to UDF. (CVE-2016-0608)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to privileges. (CVE-2016-0609)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Options. (CVE-2016-0505)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0600)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0616)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption. (CVE-2016-3452)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DDL.
(CVE-2016-0644)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser. (CVE-2016-3477)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0596)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0597)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect integrity and availability via vectors related to DML. (CVE-2016-0640)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. (CVE-2016-3521)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect integrity and availability via vectors related to Federated. (CVE-2016-0642)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect confidentiality via vectors related to DML.
(CVE-2016-0643)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to Security:
Privileges. (CVE-2016-0666)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
(CVE-2016-0651)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to Replication.
(CVE-2016-0650)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0598)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to PS.
(CVE-2016-0649)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote administrators to affect availability via vectors related to Server: RBR. (CVE-2016-5440)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Connection. (CVE-2016-5444)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect integrity via unknown vectors related to encryption. (CVE-2016-0606)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to PS.
(CVE-2016-0648)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DML.
(CVE-2016-0646)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. (CVE-2016-0546)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to FTS.
(CVE-2016-0647)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: DML. (CVE-2016-3615)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect confidentiality and availability via vectors related to MyISAM. (CVE-2016-0641)

mariadb was updated to version 10.0.25 to fix 25 security issues.

These security issues were fixed :

  - CVE-2016-0505: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Options (bsc#980904).

  - CVE-2016-0546: Unspecified vulnerability allowed local     users to affect confidentiality, integrity, and     availability via unknown vectors related to Client     (bsc#980904).

  - CVE-2016-0596: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0597: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0598: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0600: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to InnoDB (bsc#980904).

  - CVE-2016-0606: Unspecified vulnerability allowed remote     authenticated users to affect integrity via unknown     vectors related to encryption (bsc#980904).

  - CVE-2016-0608: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to UDF (bsc#980904).

  - CVE-2016-0609: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to privileges (bsc#980904).

  - CVE-2016-0616: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0640: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0641: Unspecified vulnerability allowed local     users to affect confidentiality and availability via     vectors related to MyISAM (bsc#980904).

  - CVE-2016-0642: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to Federated (bsc#980904).

  - CVE-2016-0643: Unspecified vulnerability allowed local     users to affect confidentiality via vectors related to     DML (bsc#980904).

  - CVE-2016-0644: Unspecified vulnerability allowed local     users to affect availability via vectors related to DDL     (bsc#980904).

  - CVE-2016-0646: Unspecified vulnerability allowed local     users to affect availability via vectors related to DML     (bsc#980904).

  - CVE-2016-0647: Unspecified vulnerability allowed local     users to affect availability via vectors related to FTS     (bsc#980904).

  - CVE-2016-0648: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0649: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0650: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Replication (bsc#980904).

  - CVE-2016-0651: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Optimizer (bsc#980904).

  - CVE-2016-0655: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-0666: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Security: Privileges (bsc#980904).

  - CVE-2016-0668: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-2047: The ssl_verify_server_cert function in     sql-common/client.c did not properly verify that the     server hostname matches a domain name in the subject's     Common Name (CN) or subjectAltName field of the X.509     certificate, which allowed man-in-the-middle attackers     to spoof SSL servers via a '/CN=' string in a field in a     certificate, as demonstrated by     '/OU=/CN=bar.com/CN=foo.com (bsc#963806).

These non-security issues were fixed :

  - bsc#961935: Remove the leftovers of 'openSUSE' string in     the '-DWITH_COMMENT' and 'DCOMPILATION_COMMENT' options

  - bsc#970287: remove ha_tokudb.so plugin and     tokuft_logprint and tokuftdump binaries as TokuDB     storage engine requires the jemalloc library that isn't     present in SLE-12-SP1 

  - bsc#970295: Fix the leftovers of 'logrotate.d/mysql'     string in the logrotate error message. Occurrences of     this string were changed to 'logrotate.d/mariadb' 

  - bsc#963810: Add 'log-error' and 'secure-file-priv'     configuration options

  - add '/etc/my.cnf.d/error_log.conf' that specifies     'log-error = /var/log/mysql/mysqld.log'. If no path is     set, the error log is written to     '/var/lib/mysql/$HOSTNAME.err', which is not picked up     by logrotate.

  - add '/etc/my.cnf.d/secure_file_priv.conf' which     specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD     FILE()' will only work with files in the directory     specified by 'secure-file-priv' option     (='/var/lib/mysql-files').

mariadb was updated to version 10.0.25 to fix 25 security issues.

These security issues were fixed :

  - CVE-2016-0505: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Options (bsc#980904).

  - CVE-2016-0546: Unspecified vulnerability allowed local     users to affect confidentiality, integrity, and     availability via unknown vectors related to Client     (bsc#980904).

  - CVE-2016-0596: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0597: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0598: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0600: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to InnoDB (bsc#980904).

  - CVE-2016-0606: Unspecified vulnerability allowed remote     authenticated users to affect integrity via unknown     vectors related to encryption (bsc#980904).

  - CVE-2016-0608: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to UDF (bsc#980904).

  - CVE-2016-0609: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to privileges (bsc#980904).

  - CVE-2016-0616: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0640: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0641: Unspecified vulnerability allowed local     users to affect confidentiality and availability via     vectors related to MyISAM (bsc#980904).

  - CVE-2016-0642: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to Federated (bsc#980904).

  - CVE-2016-0643: Unspecified vulnerability allowed local     users to affect confidentiality via vectors related to     DML (bsc#980904).

  - CVE-2016-0644: Unspecified vulnerability allowed local     users to affect availability via vectors related to DDL     (bsc#980904).

  - CVE-2016-0646: Unspecified vulnerability allowed local     users to affect availability via vectors related to DML     (bsc#980904).

  - CVE-2016-0647: Unspecified vulnerability allowed local     users to affect availability via vectors related to FTS     (bsc#980904).

  - CVE-2016-0648: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0649: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0650: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Replication (bsc#980904).

  - CVE-2016-0651: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Optimizer (bsc#980904).

  - CVE-2016-0655: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-0666: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Security: Privileges (bsc#980904).

  - CVE-2016-0668: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-2047: The ssl_verify_server_cert function in     sql-common/client.c did not properly verify that the     server hostname matches a domain name in the subject's     Common Name (CN) or subjectAltName field of the X.509     certificate, which allowed man-in-the-middle attackers     to spoof SSL servers via a '/CN=' string in a field in a     certificate, as demonstrated by     '/OU=/CN=bar.com/CN=foo.com (bsc#963806).

These non-security issues were fixed :

  - bsc#970295: Fix the leftovers of 'logrotate.d/mysql'     string in the logrotate error message. Occurrences of     this string were changed to 'logrotate.d/mariadb'

  - bsc#963810: Add 'log-error' and 'secure-file-priv'     configuration options

  - add '/etc/my.cnf.d/error_log.conf' that specifies     'log-error = /var/log/mysql/mysqld.log'. If no path is     set, the error log is written to     '/var/lib/mysql/$HOSTNAME.err', which is not picked up     by logrotate.

  - add '/etc/my.cnf.d/secure_file_priv.conf' which     specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD     FILE()' will only work with files in the directory     specified by 'secure-file-priv' option     (='/var/lib/mysql-files').

  - Temporarily disable OQGraph. It seems to need the boost     library with the version not earlier than 1.40 and not     later than 1.55 (MDEV-9479)

  - boo#979524: Don't remove HandlerSocket plugin 

  - boo#970287: Add 'BuildRequires: jemalloc-devel' in order     to allow enabling of the TokuDB plugin 

  - run 'usermod -g mysql mysql' only if mysql user is not     in mysql group. Run 'usermod -s /bin/false/ mysql' only     if mysql user doesn't have '/bin/false' shell set.

  - Re-enable profiling support

mysql was updated to version 5.5.49 to fix 13 security issues.

These security issues were fixed :

  - CVE-2016-0644: Unspecified vulnerability allowed local     users to affect availability via vectors related to DDL     (bsc#976341).

  - CVE-2016-0646: Unspecified vulnerability allowed local     users to affect availability via vectors related to DML     (bsc#976341).

  - CVE-2016-0647: Unspecified vulnerability allowed local     users to affect availability via vectors related to FTS     (bsc#976341).

  - CVE-2016-0640: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to DML (bsc#976341).

  - CVE-2016-0641: Unspecified vulnerability allowed local     users to affect confidentiality and availability via     vectors related to MyISAM (bsc#976341).

  - CVE-2016-0642: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to Federated (bsc#976341).

  - CVE-2016-0643: Unspecified vulnerability allowed local     users to affect confidentiality via vectors related to     DML (bsc#976341).

  - CVE-2016-0666: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Security: Privileges (bsc#976341).

  - CVE-2016-0651: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Optimizer (bsc#976341).

  - CVE-2016-0650: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Replication (bsc#976341).

  - CVE-2016-0648: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#976341).

  - CVE-2016-0649: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#976341).

  - CVE-2016-2047: The ssl_verify_server_cert function in     sql-common/client.c did not properly verify that the     server hostname matches a domain name in the subject's     Common Name (CN) or subjectAltName field of the X.509     certificate, which allowed man-in-the-middle attackers     to spoof SSL servers via a '/CN=' string in a field in a     certificate, as demonstrated by     '/OU=/CN=bar.com/CN=foo.com (bsc#963806).

More details are available at

- http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html

- http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-48.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Oracle reports reports :

Critical Patch Update contains 31 new security fixes for Oracle MySQL 5.5.48, 5.6.29, 5.7.11 and earlier

The version of MySQL installed on the remote host is version 5.5.x prior to 5.5.47 and is affected by multiple issues :

 - A flaw exists that is triggered when repeatedly executing a prepared statement when the default database has been changed.  This may allow an authenticated attacker to cause a server exit.
 - A flaw exists that is triggered when updating views using ALL comparison operators on subqueries that select from indexed columns in the main table.  This may allow an authenticated attacker to cause the server to exit.
 - An overflow condition exists in 'strcpy()' and 'sprintf()'.  The issue is triggered as user-supplied input is not properly validated.  This may allow an authenticated attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists that is triggered when handling concurrent FLUSH PRIVILEGES and REVOKE or GRANT statements.  This may allow an authenticated attacker to cause the server to exit by triggering an invalid memory access to proxy user information.
 - A flaw exists that is triggered on the second execution of a prepared statement where an ORDER BY clause references a column position.  This may allow an authenticated attacker to cause the server to exit.
 - An unspecified flaw exists related to the Client subcomponent.  This may allow a local attacker to gain elevated privileges.  No further details have been provided by the vendor. (CVE-2016-0546)
 - An unspecified flaw exists related to the Server:Security:Encryption subcomponent.  This may allow an authenticated attacker to have an unspecified impact on integrity.  No further details have been provided by the vendor. (CVE-2016-0606)

Additionally, multiple unspecified flaws exist related to the following subcomponents :
 - Server:Options
 - Server:DML
 - Server:Optimizer
 - Server:Optimizer
 - Server:DML
 - Server:InnoDB
 - Server:UDF
 - Server:Security:Privileges
These flaws may allow an authenticated attacker to cause a denial of service.  No further details have been provided by the vendor.
 - An unspecified flaw related to the Optimizer subcomponent may allow an authenticated attacker to cause a denial of service. No further details have been provided by the vendor.

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a newer upstream version:
MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes.

Security Fix(es) :

* It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047)

* This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616)

Bug Fix(es) :

* When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a 'Duplicate key' error message. A patch has been applied to prevent the race condition. Now, each row inserted as a result of the concurrent INSERT operations receives a unique primary key, and the operations no longer fail in this scenario. (BZ#1303946)

From Red Hat Security Advisory 2016:0534 :

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a newer upstream version:
MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes.

Security Fix(es) :

* It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047)

* This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616)

Bug Fix(es) :

* When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a 'Duplicate key' error message. A patch has been applied to prevent the race condition. Now, each row inserted as a result of the concurrent INSERT operations receives a unique primary key, and the operations no longer fail in this scenario. (BZ#1303946)

The version of Oracle MySQL installed on the remote host is 5.5.x prior to 5.5.47. It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw exists in the Server : Options     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0505)

  - An unspecified flaw exists in the Client subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-0546)

  - An unspecified flaw exists in the Server : DML     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0596)

  - Multiple unspecified flaws exist in the Server :
    Optimizer subcomponent that allows an authenticated,     remote attacker to cause a denial of service.
    (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616)

  - An unspecified flaw exists in the Server : InnoDB     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0600)

  - An unspecified flaw exists in the Server : Security :
    Encryption subcomponent that allows an authenticated,     remote attacker to impact integrity. (CVE-2016-0606,     CVE-2016-0609)

  - An unspecified flaw exists in the Server : UDF     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0608)

  - An unspecified flaw exists in the Optimizer subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0651)     
  - A denial of service vulnerability exists due to     repeatedly executing a prepared statement when the     default database has been changed. An authenticated,     remote attacker can exploit this to cause the server to     exit.

  - A denial of service vulnerability exists that is     triggered when updating views using ALL comparison     operators on subqueries that select from indexed columns     in the main table. An authenticated, remote attacker can     exploit this to cause the server to exit, resulting in a     denial of service condition.

  - A remote code execution vulnerability exists due to     improper validation of user-supplied input to the     strcpy() and sprintf() functions. An authenticated,     remote attacker can exploit this to cause a buffer     overflow, resulting in a denial of service condition or     the execution of arbitrary code.

  - A denial of service vulnerability exists that is     triggered when handling concurrent FLUSH PRIVILEGES and     REVOKE or GRANT statements. An authenticated, remote     attacker can exploit this to cause the server to exit by     triggering an invalid memory access to proxy user     information.

  - A denial of service vulnerability exists that is     triggered on the second execution of a prepared     statement where an ORDER BY clause references a column     position. An authenticated, remote attacker can exploit     this to cause the server to exit.

The version of MariaDB running on the remote host is 5.5.x prior to 5.5.47. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Server : Options     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0505)

  - An unspecified flaw exists in the Client subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-0546)

  - An unspecified flaw exists in the Server : DML     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0596)

  - Multiple unspecified flaws exist in the Server :
    Optimizer subcomponent that allows an authenticated,     remote attacker to cause a denial of service.
    (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616)

  - An unspecified flaw exists in the Server : InnoDB     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0600)

  - An unspecified flaw exists in the Server : Security :
    Encryption subcomponent that allows an authenticated,     remote attacker to impact integrity. (CVE-2016-0606,     CVE-2016-0609)

  - An unspecified flaw exists in the Server : UDF     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0608)     
  - A security bypass vulnerability exists due to an     incorrect implementation of the --ssl-verify-server-cert     option. A man-in-the-middle attacker can exploit this to     replace the server SSL certificate, resulting in a     bypass of the client-side hostname verification.
    (MDEV-9212)

The version of MariaDB running on the remote host is 10.1.x prior to 10.1.10. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Server : Options     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0505)

  - An unspecified flaw exists in the Client subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-0546)

  - An unspecified flaw exists in the Server : DML     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0596)

  - Multiple unspecified flaws exist in the Server :
    Optimizer subcomponent that allows an authenticated,     remote attacker to cause a denial of service.
    (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616)

  - An unspecified flaw exists in the Server : InnoDB     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0600)

  - An unspecified flaw exists in the Server : Security :
    Encryption subcomponent that allows an authenticated,     remote attacker to impact integrity. (CVE-2016-0606,     CVE-2016-0609)

  - An unspecified flaw exists in the Server : UDF     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0608)     
  - A race condition exists due to debian.cnf being created     with world-readable permissions for a small period of     time during initial installation. A local attacker can     exploit this to disclose the debian-sys-maint password.

  - A flaw exists in the decimal2string() function due to     improper handling of decimal precision greater than 40.
    An authenticated, remote attacker can exploit this to     crash the server, resulting in a denial of service     condition.

  - A security bypass vulnerability exists due to an     incorrect implementation of the --ssl-verify-server-cert     option. A man-in-the-middle attacker can exploit this to     replace the server SSL certificate, resulting in a     bypass of the client-side hostname verification.
    (MDEV-9212)

The version of MariaDB running on the remote host is 10.0.x prior to 10.0.23. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Server : Options     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0505)

  - An unspecified flaw exists in the Client subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-0546)

  - An unspecified flaw exists in the Server : DML     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0596)

  - Multiple unspecified flaws exist in the Server :
    Optimizer subcomponent that allows an authenticated,     remote attacker to cause a denial of service.
    (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616)

  - An unspecified flaw exists in the Server : InnoDB     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0600)

  - An unspecified flaw exists in the Server : Security :
    Encryption subcomponent that allows an authenticated,     remote attacker to impact integrity. (CVE-2016-0606,     CVE-2016-0609)

  - An unspecified flaw exists in the Server : UDF     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0608)

  - A flaw exists in the check_fk_parent_table_access()     function in sql_parse.cc that is triggered when     performing database name conversions. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service.

  - An overflow condition exists in the XMLColumns()     function in tabxml.cpp due to improper validation of     user-supplied input. An authenticated, remote attacker     can exploit this to cause a buffer overflow, resulting     in a denial of service condition or the execution of     arbitrary code.

  - An unspecified flaw exists that is triggered when     handling UPDATE queries with JOIN. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service.

  - A flaw exists in mysql_upgrade due to leaking plaintext     password information to the process listing when     spawning a shell process to execute mysqlcheck. A local     attacker can exploit this to disclose sensitive password     information.

  - An unspecified flaw exists that is triggered during the     handling of 'View' or 'Derived' fields. An     authenticated, remote attacker can exploit this to crash     the database, resulting in a denial of service.

  - An unspecified flaw exists in i_s.cc that is triggered     during the handling of buffer pages. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service.

  - An unspecified flaw exists in ha_innodb.cc that is     triggered when handling lower case table names. An     authenticated, remote attacker can exploit this to crash     the database, resulting in a denial of service.

  - A flaw exists in the row_merge_sort() function that is     triggered when handling FT-index creation. An     authenticated, remote attacker can exploit this to crash     the database, resulting in a denial of service.

  - An overflow condition exists in the decimal2string()     function in decimal.c due to improper validation of     user-supplied input when handling decimals in SELECT     statements. An authenticated, remote attacker can     exploit this to crash the database, resulting in a     denial of service condition.

  - A flaw exists in the mysql_prepare_create_table()     function due to improper handling of a comma buffer that     is greater than zero. An authenticated, remote attacker     can exploit this to cause a denial of service condition.

  - A flaw exists in the decimal2string() function due to     improper handling of decimal precision greater than 40.
    An authenticated, remote attacker can exploit this to     crash the server, resulting in a denial of service     condition.

  - A security bypass vulnerability exists due to an     incorrect implementation of the --ssl-verify-server-cert     option. A man-in-the-middle attacker can exploit this to     replace the server SSL certificate, resulting in a     bypass of the client-side hostname verification.
    (MDEV-9212)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.5.x prior to 5.5.47. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the Server : Options     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0505)

  - An unspecified flaw exists in the Client subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-0546)

  - An unspecified flaw exists in the Server : DML     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0596)

  - Multiple unspecified flaws exist in the Server :
    Optimizer subcomponent that allows an authenticated,     remote attacker to cause a denial of service.
    (CVE-2016-0597, CVE-2016-0598, CVE-2016-0616)

  - An unspecified flaw exists in the Server : InnoDB     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0600)

  - An unspecified flaw exists in the Server : Security :
    Encryption subcomponent that allows an authenticated,     remote attacker to impact integrity. (CVE-2016-0606,     CVE-2016-0609)

  - An unspecified flaw exists in the Server : UDF     subcomponent that allows an authenticated, remote     attacker to cause a denial of service. (CVE-2016-0608)

  - An unspecified flaw exists in the Optimizer subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0651)     
  - A denial of service vulnerability exists due to     repeatedly executing a prepared statement when the     default database has been changed. An authenticated,     remote attacker can exploit this to cause the server to     exit.

  - A denial of service vulnerability exists that is     triggered when updating views using ALL comparison     operators on subqueries that select from indexed columns     in the main table. An authenticated, remote attacker can     exploit this to cause the server to exit, resulting in a     denial of service condition.

  - A remote code execution vulnerability exists due to     improper validation of user-supplied input to the     strcpy() and sprintf() functions. An authenticated,     remote attacker can exploit this to cause a buffer     overflow, resulting in a denial of service condition or     the execution of arbitrary code.

  - A denial of service vulnerability exists that is     triggered when handling concurrent FLUSH PRIVILEGES and     REVOKE or GRANT statements. An authenticated, remote     attacker can exploit this to cause the server to exit by     triggering an invalid memory access to proxy user     information.

  - A denial of service vulnerability exists that is     triggered on the second execution of a prepared     statement where an ORDER BY clause references a column     position. An authenticated, remote attacker can exploit     this to cause the server to exit.

ID	Name	Product	Family	Severity
193833	RHEL 6 / 7 : rh-mariadb100-mariadb (RHSA-2016:1132)	Nessus	Red Hat Local Security Checks	critical
93159	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1620-1)	Nessus	SuSE Local Security Checks	medium
93158	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1619-1)	Nessus	SuSE Local Security Checks	medium
93016	Amazon Linux AMI : mysql55 (ALAS-2016-738)	Nessus	Amazon Linux Local Security Checks	high
91871	openSUSE Security Update : mariadb (openSUSE-2016-780)	Nessus	SuSE Local Security Checks	medium
91794	openSUSE Security Update : mariadb (openSUSE-2016-761)	Nessus	SuSE Local Security Checks	medium
91121	SUSE SLES11 Security Update : mysql (SUSE-SU-2016:1279-1)	Nessus	SuSE Local Security Checks	medium
90847	FreeBSD : MySQL -- multiple vulnerabilities (8c2b2f11-0ebe-11e6-b55e-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
9253	Oracle MySQL 5.5.x < 5.5.47 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
90300	RHEL 7 : mariadb (RHSA-2016:0534)	Nessus	Red Hat Local Security Checks	high
90296	Oracle Linux 7 : mariadb (ELSA-2016-0534)	Nessus	Oracle Linux Local Security Checks	high
90276	CentOS 7 : mariadb (CESA-2016:0534)	Nessus	CentOS Local Security Checks	high
88380	Oracle MySQL 5.5.x < 5.5.47 Multiple Vulnerabilities (January 2016 CPU) (April 2016 CPU)	Nessus	Databases	high
87727	MariaDB 5.5 < 5.5.47 Multiple Vulnerabilities	Nessus	Databases	medium
87726	MariaDB 10.1.x < 10.1.10 Multiple Vulnerabilities	Nessus	Databases	medium
87725	MariaDB 10.0.x < 10.0.23 Multiple Vulnerabilities	Nessus	Databases	medium
87419	MySQL 5.5.x < 5.5.47 Multiple Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2016-0651

medium

Tenable Plugins

critical

medium

medium

high

medium

medium

medium

critical

high

high

high

high

high

medium

medium

medium

high