The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier and MariaDB 10.0.x     before 10.0.25 and 10.1.x before 10.1.14 allows remote administrators to affect availability via vectors     related to Server: InnoDB. (CVE-2016-3459)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-615:02 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a     client/server implementation consisting of a server daemon (mysqld)     and many different client programs and libraries. The base package     contains the standard MySQL client programs and generic MySQL files.
    Security issues fixed with this release:
    CVE-2016-3459     Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and     5.7.12 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before     10.1.14 allows remote administrators to affect availability via     vectors related to Server: InnoDB.
    CVE-2016-3477     Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30     and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x     before 10.0.26, and 10.1.x before 10.1.15 allows local users to affect     confidentiality, integrity, and availability via vectors related to     Server: Parser.
    CVE-2016-3486     Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and     5.7.12 and earlier allows remote authenticated users to affect     availability via vectors related to Server: FTS.
    CVE-2016-3501     Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and     5.7.12 and earlier allows remote authenticated users to affect     availability via vectors related to Server: Optimizer.
    CVE-2016-3521     Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30     and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x     before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated     users to affect availability via vectors related to Server: Types.
    CVE-2016-3614     Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and     5.7.12 and earlier allows remote authenticated users to affect     availability via vectors related to Server: Security: Encryption.
    CVE-2016-3615     Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30     and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x     before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated     users to affect availability via vectors related to Server: DML.
    CVE-2016-5439     Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and     5.7.12 and earlier allows remote administrators to affect availability     via vectors related to Server: Privileges.
    CVE-2016-5440     Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30     and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x     before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators     to affect availability via vectors related to Server: RBR.
    The following packages have been upgraded to a newer upstream version: rh-mysql56-mysql (5.6.32).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.31. It is, therefore, affected by multiple vulnerabilities :

  - A heap buffer overflow condition exists in the     EVP_EncodeUpdate() function within file     crypto/evp/encode.c that is triggered when handling     a large amount of input data. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-2105)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-3452)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3459)

  - An unspecified flaw exists in the Options subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-3471)

  - An unspecified flaw exists in the Parser subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-3477)

  - An unspecified flaw exists in the FTS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3486)

  - An unspecified flaw exists in the Optimizer subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3501)

  - An unspecified flaw exists in the Types subcomponent     that allows an authenticated, remote attacker to cause     a denial of service condition. (CVE-2016-3521)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-3614)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3615)

  - An unspecified flaw exists in the Privileges     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5439)

  - An unspecified flaw exists in the RBR subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5440)

  - An unspecified flaw exists in the Connection     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5444)

  - An unspecified flaw exists in the InnoDB Plugin     subcomponent that allows an authenticated, remote     attacker to impact integrity. (CVE-2016-8288)

  - Multiple overflow conditions exist due to improper     validation of user-supplied input. An authenticated,     remote attacker can exploit these issues to cause a     denial of service condition or the execution of     arbitrary code.

  - A NULL pointer dereference flaw exists in a parser     structure that is triggered during the validation of     stored procedure names. An authenticated, remote     attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - Multiple overflow conditions exist in the InnoDB     memcached plugin due to improper validation of     user-supplied input. An authenticated, remote attacker     can exploit these issues to cause a denial of service     condition or the execution of arbitrary code.

  - An unspecified flaw exists that is triggered when     invoking Enterprise Encryption functions in multiple     threads simultaneously or after creating and dropping     them. An authenticated, remote attacker can exploit this     to crash the database, resulting in a denial of service     condition.

  - An unspecified flaw exists that is triggered when     handling a 'SELECT ... GROUP BY ... FOR UPDATE' query     executed with a loose index scan. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service condition.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Oracle reports :

The quarterly Critical Patch Update contains 22 new security fixes for Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1132 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is     binary-compatible with MySQL. MariaDB uses PCRE, a Perl-compatible regular expression library, to     implement regular expression support in SQL queries.

    Security Fix(es):

    * It was found that the MariaDB client library did not properly check host names against server identities     noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle     attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047)

    * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830,     CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913,     CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606,     CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0616, CVE-2016-0640, CVE-2016-0641, CVE-2016-0642,     CVE-2016-0643, CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650,     CVE-2016-0651, CVE-2016-0655, CVE-2016-0666, CVE-2016-0668)

    * Multiple flaws were found in the way PCRE handled malformed regular expressions. An attacker able to     make MariaDB execute an SQL query with a specially crafted regular expression could use these flaws to     cause it to crash or, possibly, execute arbitrary code. (CVE-2015-3210, CVE-2015-3217, CVE-2015-5073,     CVE-2015-8381, CVE-2015-8383, CVE-2015-8384, CVE-2015-8385, CVE-2015-8386, CVE-2015-8388, CVE-2015-8391,     CVE-2015-8392, CVE-2015-8395, CVE-2016-1283, CVE-2016-3191)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.0.25. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.25 advisory.

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to     affect confidentiality via vectors related to Server: Connection. (CVE-2016-5444)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     confidentiality via vectors related to DML. (CVE-2016-0643)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to FTS. (CVE-2016-0647)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to PS. (CVE-2016-0648)

  - Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x     before 10.0.25 and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to     InnoDB. (CVE-2016-0655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

mysql-community-server was updated to 5.6.34 to fix the following issues :

  - Changes     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     34.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     33.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     32.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     31.html

  - fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440,     CVE-2016-5584, CVE-2016-5617, CVE-2016-5616,     CVE-2016-5626, CVE-2016-3492, CVE-2016-5629,     CVE-2016-5507, CVE-2016-8283, CVE-2016-5609,     CVE-2016-5612, CVE-2016-5627, CVE-2016-5630,     CVE-2016-8284, CVE-2016-8288, CVE-2016-3477,     CVE-2016-2105, CVE-2016-3486, CVE-2016-3501,     CVE-2016-3521, CVE-2016-3615, CVE-2016-3614,     CVE-2016-3459, CVE-2016-5439, CVE-2016-5440

  - fixes SUSE Bugs: [boo#999666], [boo#998309],     [boo#1005581], [boo#1005558], [boo#1005563],     [boo#1005562], [boo#1005566], [boo#1005555],     [boo#1005569], [boo#1005557], [boo#1005582],     [boo#1005560], [boo#1005561], [boo#1005567],     [boo#1005570], [boo#1005583], [boo#1005586],     [boo#989913], [boo#977614], [boo#989914], [boo#989915],     [boo#989919], [boo#989922], [boo#989921], [boo#989911],     [boo#989925], [boo#989926]

  - append '--ignore-db-dir=lost+found' to the mysqld     options in 'mysql-systemd-helper' script if 'lost+found'     directory is found in $datadir [boo#986251] 

  - remove syslog.target from *.service files [boo#983938]

  - add systemd to deps to build on leap and friends 

  - replace '%(_libexecdir)/systemd/system' with %(_unitdir)     macro

  - remove useless mysql@default.service [boo#971456]

  - replace all occurrences of the string '@sysconfdir@'     with '/etc' in     mysql-community-server-5.6.3-logrotate.patch as it     wasn't expanded properly [boo#990890]

  - remove '%define _rundir' as 13.1 is out of support scope

  - run 'usermod -g mysql mysql' only if mysql user is not     in mysql group. Run 'usermod -s /bin/false/ mysql' only     if mysql user doesn't have '/bin/false' shell set.

  - re-enable mysql profiling

The version of MySQL running on the remote host is 5.7.x prior to 5.7.13. It is, therefore, affected by multiple vulnerabilities :

  - A heap buffer overflow condition exists in the     EVP_EncodeUpdate() function within file     crypto/evp/encode.c that is triggered when handling     a large amount of input data. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-2105)

  - Multiple unspecified flaws exist in the Optimizer     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-3424, CVE-2016-3440, CVE-2016-3501,     CVE-2016-3518)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-3452)

  - Multiple unspecified flaws exist in the InnoDB     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-3459, CVE-2016-5436)

  - An unspecified flaw exists in the Parser subcomponent     that allows a local attacker to gain elevated     privileges. (CVE-2016-3477)

  - An unspecified flaw exists in the FTS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3486)

  - An unspecified flaw exists in the Types subcomponent     that allows an authenticated, remote attacker to cause     a denial of service condition. (CVE-2016-3521)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to impact     integrity and confidentiality. (CVE-2016-3588)

  - Multiple unspecified flaws exist in the Security:
    Encryption subcomponent that allow an authenticated,     remote attacker to cause a denial of service condition.
    (CVE-2016-3614, CVE-2016-5442)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-3615)

  - An unspecified flaw exists in the Log subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5437)

  - An unspecified flaw exists in the Privileges     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5439)

  - An unspecified flaw exists in the RBR subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5440)

  - An unspecified flaw exists in the Replication     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-5441)

  - An unspecified flaw exists in the Connection     subcomponent that allows a local attacker to cause a     denial of service condition. (CVE-2016-5443)

  - An unspecified flaw exists in the Connection     subcomponent that allows an unauthenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5444)

  - An unspecified flaw exists in the InnoDB Plugin     subcomponent that allows an authenticated, remote     attacker to impact integrity. (CVE-2016-8288)

  - Multiple flaws exist in InnoDB that are triggered when     handling specially crafted 'ALTER TABLE' operations. An     authenticated, remote attacker can exploit these issues     to crash the database, resulting in a denial of service     condition.

  - Multiple overflow conditions exist due to improper     validation of user-supplied input. An authenticated,     remote attacker can exploit these issues to cause a     denial of service condition or the execution of     arbitrary code.

  - A NULL pointer dereference flaw exists in a parser     structure that is triggered during the validation of     stored procedure names. An authenticated, remote     attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - Multiple overflow conditions exist in the InnoDB     memcached plugin due to improper validation of     user-supplied input. An authenticated, remote attacker     can exploit these issues to cause a denial of service     condition or the execution of arbitrary code.

  - An unspecified flaw exists that is triggered when     invoking Enterprise Encryption functions in multiple     threads simultaneously or after creating and dropping     them. An authenticated, remote attacker can exploit this     to crash the database, resulting in a denial of service     condition.

  - An unspecified flaw exists that is triggered when     handling a 'SELECT ... GROUP BY ... FOR UPDATE' query     executed with a loose index scan. An authenticated,     remote attacker can exploit this to crash the database,     resulting in a denial of service condition.

  - An unspecified flaw exists that is triggered when     performing a 'FLUSH TABLES' operation on a table with a     discarded tablespace. An authenticated, remote attacker     can exploit this to crash the database, resulting in a     denial of service condition.

  - A flaw exists in InnoDB that is triggered when     performing an 'OPTIMIZE TABLE' operation on a table with     a full-text index. An authenticated, remote attacker can     exploit this to crash the database, resulting in a     denial of service condition.

  - An unspecified flaw exists that is triggered when     performing an UPDATE operation on a generated virtual     BLOB column. An authenticated, remote attacker can     exploit this to crash the database, resulting in a     denial of service condition.

  - An unspecified flaw exists that is triggered when     performing a 'SHOW CREATE TABLE' operation on a table     with a generated column. An authenticated, remote     attacker can exploit this to crash the database,     resulting in a denial of service condition.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1601 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a newer upstream version: rh-mysql56-mysql (5.6.32).

    Security Fix(es):

    * This update fixes several vulnerabilities in the MySQL database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2016-3459, CVE-2016-3477, CVE-2016-3486, CVE-2016-3501, CVE-2016-3521, CVE-2016-3614, CVE-2016-3615,     CVE-2016-5439, CVE-2016-5440)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
251396	Linux Distros Unpatched Vulnerability : CVE-2016-3459	Nessus	Misc.	8/18/2025	8/18/2025	medium
290017	MiracleLinux 7 : rh-mysql56-mysql-5.6.32-1.el7 (AXSA:2016-615:02)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
91995	MySQL 5.6.x < 5.6.31 Multiple Vulnerabilities	Nessus	Databases	7/20/2016	1/30/2026	high
91996	Oracle MySQL 5.6.x < 5.6.31 Multiple Vulnerabilities	Nessus	Databases	7/11/2016	6/3/2020	high
92505	FreeBSD : MySQL -- Multiple vulnerabilities (ca5cb202-4f51-11e6-b2ec-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	7/22/2016	1/30/2026	high
193833	RHEL 6 / 7 : rh-mariadb100-mariadb (RHSA-2016:1132)	Nessus	Red Hat Local Security Checks	4/24/2024	4/15/2025	critical
91765	MariaDB 10.0.0 < 10.0.25 Multiple Vulnerabilities	Nessus	Databases	6/22/2016	1/29/2026	low
94756	openSUSE Security Update : mysql-community-server (openSUSE-2016-1289)	Nessus	SuSE Local Security Checks	11/14/2016	1/19/2026	critical
91998	Oracle MySQL 5.7.x < 5.7.13 Multiple Vulnerabilities	Nessus	Databases	7/11/2016	2/18/2025	medium
210175	RHEL 6 / 7 : rh-mysql56-mysql (RHSA-2016:1601)	Nessus	Red Hat Local Security Checks	11/4/2024	2/19/2025	high
94694	openSUSE Security Update : mysql-community-server (openSUSE-2016-1283)	Nessus	SuSE Local Security Checks	11/11/2016	1/19/2026	critical

Detections

Analytics

Plugins Search

medium

high

high

high

high

critical

low

critical

medium

high

critical