The version of MariaDB installed on the remote host is prior to 5.5.45. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.45 advisory.

  - Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local     users to affect confidentiality, integrity, and availability via unknown vectors related to Client     programs. (CVE-2015-4819)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier allows remote authenticated users to     affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4816)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows remote     authenticated users to affect confidentiality, integrity, and availability via vectors related to DML.
    (CVE-2015-4879)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated mysql55-mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory pages, listed in the References section. (CVE-2014-6568, CVE-2015-0374, CVE-2015-0381, CVE-2015-0382, CVE-2015-0391, CVE-2015-0411, CVE-2015-0432, CVE-2015-0433, CVE-2015-0441, CVE-2015-0499, CVE-2015-0501, CVE-2015-0505, CVE-2015-2568, CVE-2015-2571, CVE-2015-2573, CVE-2015-2582, CVE-2015-2620, CVE-2015-2643, CVE-2015-2648, CVE-2015-4737, CVE-2015-4752, CVE-2015-4757)

These updated packages upgrade MySQL to version 5.5.45. Refer to the MySQL Release Notes listed in the References section for a complete list of changes.

All MySQL users should upgrade to these updated packages, which correct these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The version of MariaDB installed on the remote host is prior to 10.1.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.1.8 advisory.

  - Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote     authenticated users to affect availability via vectors related to Server : DML, a different vulnerability     than CVE-2015-4858. (CVE-2015-4913)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote     authenticated users to affect availability via vectors related to DML, a different vulnerability than     CVE-2015-4913. (CVE-2015-4858)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local     users to affect confidentiality, integrity, and availability via unknown vectors related to Client     programs. (CVE-2015-4819)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server : Partition, a different     vulnerability than CVE-2015-4802. (CVE-2015-4792)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server : Partition, a different     vulnerability than CVE-2015-4792. (CVE-2015-4802)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local     users to affect confidentiality, integrity, and availability via unknown vectors related to Client     programs. (CVE-2015-4819)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-198:01 advisory.

    MariaDB is a community developed branch of MySQL.
    MariaDB is a multi-user, multi-threaded SQL database server.
    It is a client/server implementation consisting of a server daemon (mysqld)     and many different client programs and libraries. The base package     contains the standard MariaDB/MySQL client programs and generic MySQL files.
    Security issues fixed with this release:
    CVE-2015-4792     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     availability via unknown vectors related to Server : Partition, a     different vulnerability than CVE-2015-4802.
    CVE-2015-4802     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     availability via unknown vectors related to Server : Partition, a     different vulnerability than CVE-2015-4792.
    CVE-2015-4815     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     availability via vectors related to Server : DDL.
    CVE-2015-4816     Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier     allows remote authenticated users to affect availability via unknown     vectors related to Server : InnoDB.
    CVE-2015-4819     Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier,     and 5.6.25 and earlier, allows local users to affect confidentiality,     integrity, and availability via unknown vectors related to Client     programs.
    CVE-2015-4826     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     confidentiality via unknown vectors related to Server : Types.
    CVE-2015-4830     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     integrity via unknown vectors related to Server : Security :
    Privileges.
    CVE-2015-4836     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,     and 5.6.26 and earlier, allows remote authenticated users to affect     availability via unknown vectors related to Server : SP.
    CVE-2015-4858     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,     and 5.6.26 and earlier, allows remote authenticated users to affect     availability via vectors related to DML, a different vulnerability     than CVE-2015-4913.
    CVE-2015-4861     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,     and 5.6.26 and earlier, allows remote authenticated users to affect     availability via unknown vectors related to Server : InnoDB.
    CVE-2015-4870     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,     and 5.6.26 and earlier, allows remote authenticated users to affect     availability via unknown vectors related to Server : Parser.
    CVE-2015-4879     Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier,     and 5.6.25 and earlier, allows remote authenticated users to affect     confidentiality, integrity, and availability via vectors related to     DML.
    CVE-2015-4913     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     availability via vectors related to Server : DML, a different     vulnerability than CVE-2015-4858.
    CVE-2016-0505     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via unknown vectors related to Options.
    CVE-2016-0546     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows local users to affect     confidentiality, integrity, and availability via unknown vectors     related to Client.
    CVE-2016-0596     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and     5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23,     and 10.1.x before 10.1.10 allows remote authenticated users to affect     availability via vectors related to DML.
    CVE-2016-0597     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via unknown vectors related to Optimizer.
    CVE-2016-0598     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via vectors related to DML.
    CVE-2016-0600     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via unknown vectors related to InnoDB.
    CVE-2016-0606     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect integrity via unknown vectors related to encryption.
    CVE-2016-0608     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via vectors related to UDF.
    CVE-2016-0609     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via unknown vectors related to privileges.
    CVE-2016-0616     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and     MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before     10.1.10 allows remote authenticated users to affect availability via     unknown vectors related to Optimizer.
    CVE-2016-2047     The ssl_verify_server_cert function in sql-common/client.c in MariaDB     before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10,     Oracle MySQL, and Percona Server do not properly verify that the     server hostname matches a domain name in the subject's Common Name     (CN) or subjectAltName field of the X.509 certificate, which allows     man-in-the-middle attackers to spoof SSL servers via a /CN= string     in a field in a certificate, as demonstrated by     /OU=/CN=bar.com/CN=foo.com.
    The following packages have been upgraded to a newer upstream version: MariaDB (5.5.47). Refer to the     MariaDB Release Notes listed in the References section for a complete list of changes.
    Fixed bugs:
    * When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an     AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could     occur. As a consequence, one of the concurrent INSERT operations failed with a Duplicate key error     message. A patch has been applied to prevent the race condition. Now, each row inserted as a result of the     concurrent INSERT operations receives a unique primary key, and the operations no longer fail in this     scenario.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.27. It is, therefore, potentially affected by the following vulnerabilities :

  - A certificate validation bypass vulnerability exists in     the Security:Encryption subcomponent due to a flaw in     the X509_verify_cert() function in x509_vfy.c that is     triggered when locating alternate certificate chains     when the first attempt to build such a chain fails. A     remote attacker can exploit this, by using a valid leaf     certificate as a certificate authority (CA), to issue     invalid certificates that will bypass authentication.
    (CVE-2015-1793)

  - An unspecified flaw exists in the Client Programs     subcomponent. A local attacker can exploit this to gain     elevated privileges. (CVE-2015-4819)

  - An unspecified flaw exists in the Types subcomponent.
    An authenticated, remote attacker can exploit this to     gain access to sensitive information. (CVE-2015-4826)

  - An unspecified flaws exist in the Security:Privileges     subcomponent. An authenticated, remote attacker can     exploit these to impact integrity. (CVE-2015-4830,     CVE-2015-4864)

  - An unspecified flaw exists in the DLM subcomponent.
    An authenticated, remote attacker can exploit this to     impact integrity. (CVE-2015-4879)

  - An unspecified flaw exists in the Server Security     Encryption subcomponent that allows an authenticated,     remote attacker to disclose sensitive information.
    (CVE-2015-7744)

Additionally, unspecified denial of service vulnerabilities can also exist in the following MySQL subcomponents :

  - DDL (CVE-2015-4815)

  - DML (CVE-2015-4858, CVE-2015-4862, CVE-2015-4905,     CVE-2015-4913)

  - InnoDB (CVE-2015-4861, CVE-2015-4866, CVE-2015-4895)

  - libmysqld (CVE-2015-4904)

  - Memcached (CVE-2015-4910)

  - Optimizer (CVE-2015-4800)

  - Parser (CVE-2015-4870)

  - Partition (CVE-2015-4792, CVE-2015-4802, CVE-2015-4833)

  - Query (CVE-2015-4807)

  - Replication (CVE-2015-4890)

  - Security : Firewall (CVE-2015-4766)

  - Server : General (CVE-2016-0605)

  - Security : Privileges (CVE-2015-4791)

  - SP (CVE-2015-4836)

  - Types (CVE-2015-4730)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.46. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details :

  -     https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5
    -45.html
  -     https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5
    -46.html

  -     http://www.oracle.com/technetwork/topics/security/cpuoct     2015-2367953.html

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a newer upstream version:
MariaDB (5.5.47). Refer to the MariaDB Release Notes listed in the References section for a complete list of changes.

Security Fix(es) :

* It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047)

* This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4913, CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606, CVE-2016-0608, CVE-2016-0609, CVE-2016-0616)

Bug Fix(es) :

* When more than one INSERT operation was executed concurrently on a non-empty InnoDB table with an AUTO_INCREMENT column defined as a primary key immediately after starting MariaDB, a race condition could occur. As a consequence, one of the concurrent INSERT operations failed with a 'Duplicate key' error message. A patch has been applied to prevent the race condition. Now, each row inserted as a result of the concurrent INSERT operations receives a unique primary key, and the operations no longer fail in this scenario. (BZ#1303946)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0534 advisory.

  - mysql: unspecified vulnerability related to Server:Partition (CPU October 2015) (CVE-2015-4792,     CVE-2015-4802)

  - mysql: unspecified vulnerability related to Server:DDL (CPU October 2015) (CVE-2015-4815)

  - mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015) (CVE-2015-4816,     CVE-2015-4861)

  - mysql: unspecified vulnerability related to Client programs (CPU October 2015) (CVE-2015-4819)

  - mysql: unspecified vulnerability related to Server:Types (CPU October 2015) (CVE-2015-4826)

  - mysql: unspecified vulnerability related to Server:Security:Privileges (CPU October 2015) (CVE-2015-4830)

  - mysql: unspecified vulnerability related to Server:SP (CPU October 2015) (CVE-2015-4836)

  - mysql: unspecified vulnerability related to Server:DML (CPU October 2015) (CVE-2015-4858, CVE-2015-4879,     CVE-2015-4913)

  - mysql: unspecified vulnerability related to Server:Parser (CPU October 2015) (CVE-2015-4870)

  - mysql: unspecified vulnerability in subcomponent: Server: Options (CPU January 2016) (CVE-2016-0505)

  - mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016) (CVE-2016-0546)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016) (CVE-2016-0596,     CVE-2016-0598)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016) (CVE-2016-0597,     CVE-2016-0616)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016) (CVE-2016-0600)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016)     (CVE-2016-0606)

  - mysql: unspecified vulnerability in subcomponent: Server: UDF (CPU January 2016) (CVE-2016-0608)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU January 2016)     (CVE-2016-0609)

  - mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU April 2016) (CVE-2016-0642)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016) (CVE-2016-0651)

  - mysql: ssl-validate-cert incorrect hostname check (CVE-2016-2047)

  - mysql: unspecified vulnerability in subcomponent: Server: Option (CPU July 2016) (CVE-2016-3471)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements.

The following CVEs have been fixed :

  - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815,     CVE-2015-4826, CVE-2015-4830, CVE-2015-4836,     CVE-2015-4858, CVE-2015-4861, CVE-2015-4870,     CVE-2015-4913, CVE-2015-4792

  - 10.0.21: CVE-2015-4816, CVE-2015-4819, CVE-2015-4879,     CVE-2015-4895

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
93846	MariaDB 5.5.0 < 5.5.45 Multiple Vulnerabilities	Nessus	Databases	10/4/2016	1/29/2026	medium
85460	CentOS 5 : mysql55-mysql (CESA-2015:1628)	Nessus	CentOS Local Security Checks	8/18/2015	1/4/2021	high
167902	MariaDB 10.1.0 < 10.1.8 Multiple Vulnerabilities	Nessus	Databases	11/18/2022	1/29/2026	medium
218920	Linux Distros Unpatched Vulnerability : CVE-2015-4819	Nessus	Misc.	3/4/2025	8/21/2025	high
289346	MiracleLinux 7 : mariadb-5.5.47-1.el7 (AXSA:2016-198:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	medium
86547	MySQL 5.6.x < 5.6.27 Multiple Vulnerabilities	Nessus	Databases	10/22/2015	11/15/2018	high
86580	Debian DSA-3377-1 : mysql-5.5 - security update	Nessus	Debian Local Security Checks	10/26/2015	1/11/2021	high
90276	CentOS 7 : mariadb (CESA-2016:0534)	Nessus	CentOS Local Security Checks	4/1/2016	1/4/2021	high
90300	RHEL 7 : mariadb (RHSA-2016:0534)	Nessus	Red Hat Local Security Checks	4/1/2016	4/27/2024	high
87964	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0121-1)	Nessus	SuSE Local Security Checks	1/18/2016	1/6/2021	high

Detections

Analytics

Plugins Search

medium

high

medium

high

medium

high

high

high

high

high