Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The version of MariaDB installed on the remote host is prior to 10.2.12. It is, therefore, affected by a vulnerability as referenced in the mariadb-10-2-12-release-notes advisory.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported     versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior.
    Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols     to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-3133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.0.34. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-10-0-34-release-notes advisory.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported     versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or     delete access to some of MySQL Server accessible data. (CVE-2018-2562)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions     that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. (CVE-2018-2612)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported     versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-2622)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported     versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-2640, CVE-2018-2665,     CVE-2018-2668)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported     versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior.
    Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols     to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-3133)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 5.5.59. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-5-5-59-release-notes advisory.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported     versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or     delete access to some of MySQL Server accessible data. (CVE-2018-2562)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported     versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-2622)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported     versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-2640, CVE-2018-2665,     CVE-2018-2668)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported     versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior.
    Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols     to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-3133)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.1.30. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-10-1-30-release-notes advisory.

  - sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster     before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3 allows remote authenticated users with SQL access to     bypass intended access restrictions and replicate data definition language (DDL) statements to cluster     nodes by leveraging incorrect ordering of DDL replication and ACL checking. (CVE-2017-15365)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported     versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior.
    Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols     to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-3133)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has mariadb packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Client mysqldump). Supported     versions that are affected are 5.5.56 and earlier,     5.6.36 and earlier and 5.7.18 and earlier. Easily     exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data. CVSS 3.0     Base Score 4.3 (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
    (CVE-2017-3651)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Client programs). Supported     versions that are affected are 5.5.56 and earlier and     5.6.36 and earlier. Easily exploitable vulnerability     allows low privileged attacker with logon to the     infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data as well     as unauthorized read access to a subset of MySQL Server     accessible data and unauthorized ability to cause a     partial denial of service (partial DOS) of MySQL Server.
    CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
    (CVE-2017-3636)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: DML). Supported versions     that are affected are 5.5.56 and earlier, 5.6.36 and     earlier and 5.7.18 and earlier. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2017-3641)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: DDL). Supported versions     that are affected are 5.5.56 and earlier, 5.6.36 and     earlier and 5.7.18 and earlier. Difficult to exploit     vulnerability allows low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete     access to some of MySQL Server accessible data. CVSS 3.0     Base Score 3.1 (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).
    (CVE-2017-3653)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: Optimizer). Supported     versions that are affected are 5.5.57 and earlier,     5.6.37 and earlier and 5.7.11 and earlier. Easily     exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 6.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2017-10378)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: Replication). Supported     versions that are affected are 5.5.57 and earlier,     5.6.37 and earlier and 5.7.19 and earlier. Difficult to     exploit vulnerability allows high privileged attacker     with logon to the infrastructure where MySQL Server     executes to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized access     to critical data or complete access to all MySQL Server     accessible data. CVSS 3.0 Base Score 4.1     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2017-10268)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Client programs). Supported     versions that are affected are 5.5.57 and earlier,     5.6.37 and earlier and 5.7.19 and earlier. Easily     exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized access to critical data or     complete access to all MySQL Server accessible data.
    CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS     Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2017-10379)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: DDL). Supported versions     that are affected are 5.5.57 and earlier 5.6.37 and     earlier 5.7.19 and earlier. Easily exploitable     vulnerability allows low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 6.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2017-10384)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: Replication). Supported     versions that are affected are 5.5.59 and prior, 5.6.39     and prior and 5.7.21 and prior. Difficult to exploit     vulnerability allows unauthenticated attacker with logon     to the infrastructure where MySQL Server executes to     compromise MySQL Server. Successful attacks require     human interaction from a person other than the attacker     and while the vulnerability is in MySQL Server, attacks     may significantly impact additional products. Successful     attacks of this vulnerability can result in takeover of     MySQL Server. CVSS 3.0 Base Score 7.7 (Confidentiality,     Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
    (CVE-2018-2755)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: Security: Encryption).
    Supported versions that are affected are 5.5.60 and     prior, 5.6.40 and prior and 5.7.22 and prior. Difficult     to exploit vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized read access to a subset of     MySQL Server accessible data. CVSS 3.0 Base Score 3.1     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2018-2767)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server : Partition). Supported     versions that are affected are 5.5.58 and prior, 5.6.38     and prior and 5.7.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server as well as unauthorized update, insert or delete     access to some of MySQL Server accessible data. CVSS 3.0     Base Score 7.1 (Integrity and Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).
    (CVE-2018-2562)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: DDL). Supported versions     that are affected are 5.5.58 and prior, 5.6.38 and prior     and 5.7.20 and prior. Easily exploitable vulnerability     allows low privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. CVSS     3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2018-2622)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: Optimizer). Supported     versions that are affected are 5.5.58 and prior, 5.6.38     and prior and 5.7.20 and prior. Easily exploitable     vulnerability allows low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 6.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2018-2640, CVE-2018-2665, CVE-2018-2668)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Client programs). Supported     versions that are affected are 5.5.59 and prior, 5.6.39     and prior and 5.7.21 and prior. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 5.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2018-2761)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: Locking). Supported     versions that are affected are 5.5.59 and prior, 5.6.39     and prior and 5.7.21 and prior. Difficult to exploit     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 4.4 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2018-2771)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: Optimizer). Supported     versions that are affected are 5.5.59 and prior, 5.6.39     and prior and 5.7.21 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2018-2781)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: DDL). Supported versions     that are affected are 5.5.59 and prior, 5.6.39 and prior     and 5.7.21 and prior. Easily exploitable vulnerability     allows low privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized read access to a subset of MySQL Server     accessible data. CVSS 3.0 Base Score 4.3     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2018-2813)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: DDL). Supported versions     that are affected are 5.5.59 and prior, 5.6.39 and prior     and 5.7.21 and prior. Easily exploitable vulnerability     allows low privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. CVSS     3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2018-2817)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: InnoDB). Supported versions that     are affected are 5.5.59 and prior, 5.6.39 and prior and     5.7.21 and prior. Easily exploitable vulnerability     allows low privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. CVSS     3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2018-2819)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: Parser). Supported versions     that are affected are 5.6.42 and prior, 5.7.24 and prior     and 8.0.13 and prior. Easily exploitable vulnerability     allows low privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. CVSS     3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2019-2455)

  - Vulnerability in the MySQL Server component of Oracle     MySQL (subcomponent: Server: Parser). Supported versions     that are affected are 5.5.61 and prior, 5.6.41 and     prior, 5.7.23 and prior and 8.0.12 and prior. Easily     exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 6.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2018-3133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the mysql package has been released.

The version of MySQL running on the remote host is 5.5.x prior to 5.5.62. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

**MySQL 8.0.13**

Release notes :

https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-13.html

CVEs fixed :

CVE-2018-3276 CVE-2018-3200 CVE-2018-3137 CVE-2018-3284 CVE-2018-3195 CVE-2018-3173 CVE-2018-3212 CVE-2018-3279 CVE-2018-3162 CVE-2018-3247 CVE-2018-3156 CVE-2018-3161 CVE-2018-3278 CVE-2018-3174 CVE-2018-3282 CVE-2018-3285 CVE-2018-3187 CVE-2018-3277 CVE-2018-3144 CVE-2018-3145 CVE-2018-3170 CVE-2018-3186 CVE-2018-3182 CVE-2018-3133 CVE-2018-3143 CVE-2018-3283 CVE-2018-3171 CVE-2018-3251 CVE-2018-3286 CVE-2018-3185 CVE-2018-3280 CVE-2018-3203 CVE-2018-3155

Maintainer's notes :

MySQL now builds MySQL Router (for innoDB cluster) as a part of the server. However since it can't be used without MySQL Shell, whuch is not packed to Fedora, nor the Router is allowed to be built & packed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**MySQL 5.7.24**

Release notes :

https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-24.html

CVEs fixed :

CVE-2018-3276 CVE-2018-3200 CVE-2018-3284 CVE-2018-3173 CVE-2018-3162 CVE-2018-3247 CVE-2018-3156 CVE-2018-3161 CVE-2018-3278 CVE-2018-3282 CVE-2018-3187 CVE-2018-3277 CVE-2018-3144 CVE-2018-3133 CVE-2018-3143 CVE-2018-3283 CVE-2018-3171 CVE-2018-3251 CVE-2018-3185 CVE-2018-3155

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H).(CVE-2018-3174)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3133)

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.(CVE-2016-9843)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Storage Engines). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3282)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3251)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3156)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Storage Engines). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3282)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3143)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Merge). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2018-3247)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3133)

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.(CVE-2016-9843)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior.
Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3276)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H).(CVE-2018-3174)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: RBR). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3278)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).(CVE-2018-3155)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3284)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Partition). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3161)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3143)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3251)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Merge). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2018-3247)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Partition). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.0 (Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2018-3171)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Audit). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3144)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3173)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: RBR). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3278)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Logging). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3283)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3156)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Storage Engines). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3282)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3133)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3162)

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.(CVE-2016-9843)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached). Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior.
Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3276)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H).(CVE-2018-3174)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2018-3277)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).(CVE-2018-3277)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2018-3185)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).(CVE-2018-3187)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.62, which includes additional changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details :

https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-61.html https://www.oracle.com/technetwork/security-advisory/cpujul2018-425824 7.html https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-62.html https://www.oracle.com/technetwork/security-advisory/cpuoct2018-442829 6.html

For Debian 8 'Jessie', these problems have been fixed in version 5.5.62-0+deb8u1.

We recommend that you upgrade your mysql-5.5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MySQL server was updated to version 5.5.62, fixing bugs and security issues.

Changes :

http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-62.html

Following security issues were fixed :

CVE-2016-9843: The crc32_big function in zlib might have allowed context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. (bsc#1013882) Please note that SUSE uses the system zlib, not the embedded copy.

CVE-2018-3133: Authenticated low privilege attackers could cause denial of service attacks (hangs or crashes) against the mysql server (bsc#1112369)

CVE-2018-3174: Authenticated high privilege attackers could cause denial of service attacks (hangs or crashes) against the mysql server (bsc#1112368)

CVE-2018-3282: Authenticated high privilege attackers could cause denial of service attacks (hangs or crashes) against the mysql server (bsc#1112432)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MySQL Community Server was updated to 5.6.42, fixing bugs and security issues :

Changes:
http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-42.html

Fixed CVEs :

  - CVE-2016-9843 [boo#1013882], CVE-2018-3143     [boo#1112421],

  - CVE-2018-3156 [boo#1112417], CVE-2018-3251     [boo#1112397], 

  - CVE-2018-3133 [boo#1112369], CVE-2018-3247     [boo#1112398],

  - CVE-2018-3174 [boo#1112368], CVE-2018-3276     [boo#1112393],

  - CVE-2018-3278 [boo#1112390], CVE-2018-3282     [boo#1112432],

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.5.62 in Ubuntu 14.04 LTS. Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10 have been updated to MySQL 5.7.24.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-62.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-24.html https://www.oracle.com/technetwork/security-advisory/cpuoct2018-442829 6.html.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Oracle reports :

Please reference CVE/URL list for details

The version of MySQL running on the remote host is 8.0.x prior to 8.0.13. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.24 It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 and July 2019 Critical Patch Update advisories. Please consult the CVRF details for the applicable CVEs for additional information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.42. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.5.x prior to 5.5.62. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version:
mariadb (5.5.60). (BZ#1584668, BZ#1584671, BZ#1584674, BZ#1601085)

Security Fix(es) :

* mysql: Client programs unspecified vulnerability (CPU Jul 2017) (CVE-2017-3636)

* mysql: Server: DML unspecified vulnerability (CPU Jul 2017) (CVE-2017-3641)

* mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017) (CVE-2017-3651)

* mysql: Server: Replication unspecified vulnerability (CPU Oct 2017) (CVE-2017-10268)

* mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017) (CVE-2017-10378)

* mysql: Client programs unspecified vulnerability (CPU Oct 2017) (CVE-2017-10379)

* mysql: Server: DDL unspecified vulnerability (CPU Oct 2017) (CVE-2017-10384)

* mysql: Server: Partition unspecified vulnerability (CPU Jan 2018) (CVE-2018-2562)

* mysql: Server: DDL unspecified vulnerability (CPU Jan 2018) (CVE-2018-2622)

* mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018) (CVE-2018-2640)

* mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018) (CVE-2018-2665)

* mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018) (CVE-2018-2668)

* mysql: Server: Replication unspecified vulnerability (CPU Apr 2018) (CVE-2018-2755)

* mysql: Client programs unspecified vulnerability (CPU Apr 2018) (CVE-2018-2761)

* mysql: Server: Locking unspecified vulnerability (CPU Apr 2018) (CVE-2018-2771)

* mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2018) (CVE-2018-2781)

* mysql: Server: DDL unspecified vulnerability (CPU Apr 2018) (CVE-2018-2813)

* mysql: Server: DDL unspecified vulnerability (CPU Apr 2018) (CVE-2018-2817)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2018) (CVE-2018-2819)

* mysql: Server: DDL unspecified vulnerability (CPU Jul 2017) (CVE-2017-3653)

* mysql: use of SSL/TLS not enforced in libmysqld (Return of BACKRONYM) (CVE-2018-2767)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Previously, the mysqladmin tool waited for an inadequate length of time if the socket it listened on did not respond in a specific way.
Consequently, when the socket was used while the MariaDB server was starting, the mariadb service became unresponsive for a long time.
With this update, the mysqladmin timeout has been shortened to 2 seconds. As a result, the mariadb service either starts or fails but no longer hangs in the described situation. (BZ#1584023)

From Red Hat Security Advisory 2018:2439 :

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version:
mariadb (5.5.60). (BZ#1584668, BZ#1584671, BZ#1584674, BZ#1601085)

Security Fix(es) :

* mysql: Client programs unspecified vulnerability (CPU Jul 2017) (CVE-2017-3636)

* mysql: Server: DML unspecified vulnerability (CPU Jul 2017) (CVE-2017-3641)

* mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017) (CVE-2017-3651)

* mysql: Server: Replication unspecified vulnerability (CPU Oct 2017) (CVE-2017-10268)

* mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017) (CVE-2017-10378)

* mysql: Client programs unspecified vulnerability (CPU Oct 2017) (CVE-2017-10379)

* mysql: Server: DDL unspecified vulnerability (CPU Oct 2017) (CVE-2017-10384)

* mysql: Server: Partition unspecified vulnerability (CPU Jan 2018) (CVE-2018-2562)

* mysql: Server: DDL unspecified vulnerability (CPU Jan 2018) (CVE-2018-2622)

* mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018) (CVE-2018-2640)

* mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018) (CVE-2018-2665)

* mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018) (CVE-2018-2668)

* mysql: Server: Replication unspecified vulnerability (CPU Apr 2018) (CVE-2018-2755)

* mysql: Client programs unspecified vulnerability (CPU Apr 2018) (CVE-2018-2761)

* mysql: Server: Locking unspecified vulnerability (CPU Apr 2018) (CVE-2018-2771)

* mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2018) (CVE-2018-2781)

* mysql: Server: DDL unspecified vulnerability (CPU Apr 2018) (CVE-2018-2813)

* mysql: Server: DDL unspecified vulnerability (CPU Apr 2018) (CVE-2018-2817)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2018) (CVE-2018-2819)

* mysql: Server: DDL unspecified vulnerability (CPU Jul 2017) (CVE-2017-3653)

* mysql: use of SSL/TLS not enforced in libmysqld (Return of BACKRONYM) (CVE-2018-2767)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Previously, the mysqladmin tool waited for an inadequate length of time if the socket it listened on did not respond in a specific way.
Consequently, when the socket was used while the MariaDB server was starting, the mariadb service became unresponsive for a long time.
With this update, the mysqladmin timeout has been shortened to 2 seconds. As a result, the mariadb service either starts or fails but no longer hangs in the described situation. (BZ#1584023)

ID	Name	Product	Family	Severity
167898	MariaDB 10.2.0 < 10.2.12	Nessus	Databases	medium
167897	MariaDB 10.0.0 < 10.0.34 Multiple Vulnerabilities	Nessus	Databases	high
167876	MariaDB 5.5.0 < 5.5.59 Multiple Vulnerabilities	Nessus	Databases	high
167856	MariaDB 10.1.0 < 10.1.30 Multiple Vulnerabilities	Nessus	Databases	high
127203	NewStart CGSL CORE 5.04 / MAIN 5.04 : mariadb Multiple Vulnerabilities (NS-SA-2019-0034)	Nessus	NewStart CGSL Local Security Checks	high
126216	Photon OS 2.0: Mysql PHSA-2019-2.0-0152	Nessus	PhotonOS Local Security Checks	high
700617	MySQL 5.5.x < 5.5.62 Multiple Vulnerabilities (October 2018 CPU)	Nessus Network Monitor	Database	critical
120783	Fedora 29 : community-mysql (2018-c82fc3e109)	Nessus	Fedora Local Security Checks	medium
120722	Fedora 28 : community-mysql (2018-b4820696e1)	Nessus	Fedora Local Security Checks	medium
119475	Amazon Linux AMI : mysql55 (ALAS-2018-1116)	Nessus	Amazon Linux Local Security Checks	critical
119474	Amazon Linux AMI : mysql56 (ALAS-2018-1115)	Nessus	Amazon Linux Local Security Checks	critical
119473	Amazon Linux AMI : mysql57 (ALAS-2018-1114)	Nessus	Amazon Linux Local Security Checks	critical
119156	Fedora 27 : community-mysql (2018-4ae94c8deb)	Nessus	Fedora Local Security Checks	high
118734	Debian DLA-1566-1 : mysql-5.5 security update	Nessus	Debian Local Security Checks	medium
118499	SUSE SLES11 Security Update : mysql (SUSE-SU-2018:3542-1)	Nessus	SuSE Local Security Checks	critical
118452	openSUSE Security Update : mysql-community-server (openSUSE-2018-1284)	Nessus	SuSE Local Security Checks	critical
118359	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : MySQL vulnerabilities (USN-3799-1)	Nessus	Ubuntu Local Security Checks	medium
118248	FreeBSD : MySQL -- multiple vulnerabilities (ec5072b0-d43a-11e8-a6d2-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
118236	MySQL 8.0.x < 8.0.13 Multiple Vulnerabilities (Oct 2018 CPU) (Jul 2019 CPU)	Nessus	Databases	critical
118235	MySQL 5.7.x < 5.7.24 Multiple Vulnerabilities (Oct 2018 CPU) (Jul 2019 CPU)	Nessus	Databases	critical
118234	MySQL 5.6.x < 5.6.42 Multiple Vulnerabilities (October 2018 CPU)	Nessus	Databases	critical
118233	MySQL 5.5.x < 5.5.62 Multiple Vulnerabilities (October 2018 CPU)	Nessus	Databases	critical
112020	CentOS 7 : mariadb (CESA-2018:2439)	Nessus	CentOS Local Security Checks	high
111802	RHEL 7 : mariadb (RHSA-2018:2439)	Nessus	Red Hat Local Security Checks	high
111800	Oracle Linux 7 : mariadb (ELSA-2018-2439)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2018-3133

medium

Tenable Plugins

medium

high

high

high

high

high

critical

medium

medium

critical

critical

critical

high

medium

critical

critical

medium

critical

critical

critical

critical

critical

high

high

high