The version of MariaDB installed on the remote host is prior to 5.5.55. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.55 advisory.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of MySQL Server accessible data. (CVE-2017-3464)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM). Supported     versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to     exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server     executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all MySQL Server accessible data. CVSS v3.0 Base Score 4.7     (Confidentiality impacts). (CVE-2017-3313)

  - Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through     5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3. (CVE-2017-3302)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2017-3308)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2017-3309)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2017-3308)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of MariaDB installed on the remote host is prior to 10.0.31. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.31 advisory.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of MySQL Server accessible data. (CVE-2017-3464)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2017-3308)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2017-3309)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily     exploitable vulnerability allows low privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2017-3453)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily     exploitable vulnerability allows high privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2017-3456)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.55, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details :

https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-55.html http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618 .html

For Debian 7 'Wheezy', these problems have been fixed in version 5.5.55-0+deb7u1.

We recommend that you upgrade your mysql-5.5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2192 advisory.

    - Rebase to 5.5.56       That release also fixes the following security issues:
      CVE-2016-5617/CVE-2016-6664 CVE-2017-3312 CVE-2017-3238 CVE-2017-3243       CVE-2017-3244 CVE-2017-3258 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318       CVE-2017-3291 CVE-2017-3302 CVE-2016-5483/CVE-2017-3600 CVE-2017-3308       CVE-2017-3309 CVE-2017-3453 CVE-2017-3456 CVE-2017-3464       Resolves: #1458933       New deps required by upstream: checkpolicy and policycoreutils-python       License text removed by upstream: COPYING.LESSER       Do not ignore test-suite failure       Downstream script mariadb-prepare-db-dir fixed for CVE-2017-3265       Resolves: #1458940

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2644:01 advisory.

    * mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016)     (CVE-2016-5617, CVE-2016-6664)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2017)     (CVE-2017-3238)
    * mysql: Server: Charsets unspecified vulnerability (CPU Jan 2017)     (CVE-2017-3243)
    * mysql: Server: DML unspecified vulnerability (CPU Jan 2017) (CVE-2017-3244)
    * mysql: Server: InnoDB unspecified vulnerability (CPU Jan 2017) (CVE-2017-3257)
    * mysql: Server: DDL unspecified vulnerability (CPU Jan 2017) (CVE-2017-3258)
    * mysql: unsafe chmod/chown use in init script (CPU Jan 2017) (CVE-2017-3265)
    * mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017) (CVE-2017-3291)
    * mysql: Server: DML unspecified vulnerability (CPU Apr 2017) (CVE-2017-3308)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)     (CVE-2017-3309)
    * mysql: insecure error log file handling in mysqld_safe, incomplete     CVE-2016-6664 fix (CPU Jan 2017) (CVE-2017-3312)
    * mysql: Server: MyISAM unspecified vulnerability (CPU Jan 2017) (CVE-2017-3313)
    * mysql: Logging unspecified vulnerability (CPU Jan 2017) (CVE-2017-3317)
    * mysql: Server: Error Handling unspecified vulnerability (CPU Jan 2017)     (CVE-2017-3318)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)     (CVE-2017-3453)
    * mysql: Server: DML unspecified vulnerability (CPU Apr 2017) (CVE-2017-3456)
    * mysql: Server: DDL unspecified vulnerability (CPU Apr 2017) (CVE-2017-3464)
    * mysql: Client programs unspecified vulnerability (CPU Jul 2017)     (CVE-2017-3636)
    * mysql: Server: DML unspecified vulnerability (CPU Jul 2017) (CVE-2017-3641)
    * mysql: Server: Replication unspecified vulnerability (CPU Oct 2017)     (CVE-2017-10268)
    * mysql: Server: InnoDB unspecified vulnerability (CPU Oct 2017)     (CVE-2017-10286)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017)     (CVE-2017-10378)
    * mysql: Client programs unspecified vulnerability (CPU Oct 2017)     (CVE-2017-10379)
    * mysql: Server: DDL unspecified vulnerability (CPU Oct 2017) (CVE-2017-10384)
    * mysql: prepared statement handle use-after-free after disconnect     (CVE-2017-3302)
    * mysql: Server: DDL unspecified vulnerability (CPU Jul 2017) (CVE-2017-3653)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
167878	MariaDB 5.5.0 < 5.5.55 Multiple Vulnerabilities	Nessus	Databases	11/18/2022	1/29/2026	medium
220999	Linux Distros Unpatched Vulnerability : CVE-2017-3308	Nessus	Misc.	3/4/2025	8/18/2025	high
104437	MariaDB 10.0.0 < 10.0.31 Multiple Vulnerabilities	Nessus	Databases	11/7/2017	1/29/2026	medium
99673	Debian DLA-916-1 : mysql-5.5 security update (Riddle)	Nessus	Debian Local Security Checks	4/26/2017	12/23/2025	medium
102299	Oracle Linux 7 : mariadb (ELSA-2017-2192)	Nessus	Oracle Linux Local Security Checks	8/9/2017	12/2/2025	high
289536	MiracleLinux 4 : rh-mariadb101-galera-25.3.12-12.AXS4, rh-mariadb101-mariadb-10.1.29-3.AXS4 (AXSA:2018-2644:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	2/9/2026	high

Detections

Analytics

Plugins Search

medium

high

medium

medium

high

high