According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - MariaDB is a community developed branch of MySQL.
    MariaDB is a multi-user, multi-threaded SQL database     server. It is a client/server implementation consisting     of a server daemon (mysqld) and many different client     programs and libraries. The base package contains the     standard MariaDB/MySQL client programs and generic     MySQL files.

  - Security Fix(es)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     integrity and availability via vectors related to     DML.(CVE-2016-0640)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     confidentiality and availability via vectors related to     MyISAM.(CVE-2016-0641)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     confidentiality via vectors related to     DML.(CVE-2016-0643)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to DDL.(CVE-2016-0644)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to DML.(CVE-2016-0646)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     availability via vectors related to FTS.(CVE-2016-0647)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     availability via vectors related to PS.(CVE-2016-0648)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to PS.(CVE-2016-0649)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to     Replication.(CVE-2016-0650)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     availability via vectors related to Security:
    Privileges.(CVE-2016-0666)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows remote attackers to affect     confidentiality via vectors related to Server:
    Security: Encryption.(CVE-2016-3452)

  - Unspecified vulnerability in Oracle MySQL 5.5.49 and     earlier, 5.6.30 and earlier, and 5.7.12 and earlier and     MariaDB before 5.5.50, 10.0.x before 10.0.26, and     10.1.x before 10.1.15 allows local users to affect     confidentiality, integrity, and availability via     vectors related to Server: Parser.(CVE-2016-3477)

  - Unspecified vulnerability in Oracle MySQL 5.5.49 and     earlier, 5.6.30 and earlier, and 5.7.12 and earlier and     MariaDB before 5.5.50, 10.0.x before 10.0.26, and     10.1.x before 10.1.15 allows remote authenticated users     to affect availability via vectors related to Server:
    Types.(CVE-2016-3521)

  - Unspecified vulnerability in Oracle MySQL 5.5.49 and     earlier, 5.6.30 and earlier, and 5.7.12 and earlier and     MariaDB before 5.5.50, 10.0.x before 10.0.26, and     10.1.x before 10.1.15 allows remote authenticated users     to affect availability via vectors related to Server:
    DML.(CVE-2016-3615)

  - Unspecified vulnerability in Oracle MySQL 5.5.49 and     earlier, 5.6.30 and earlier, and 5.7.12 and earlier and     MariaDB before 5.5.50, 10.0.x before 10.0.26, and     10.1.x before 10.1.15 allows remote administrators to     affect availability via vectors related to Server:
    RBR.(CVE-2016-5440)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows remote attackers to affect     confidentiality via vectors related to Server:
    Connection.(CVE-2016-5444)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MariaDB installed on the remote host is prior to 10.0.25. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.25 advisory.

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to     affect confidentiality via vectors related to Server: Connection. (CVE-2016-5444)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     confidentiality via vectors related to DML. (CVE-2016-0643)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to FTS. (CVE-2016-0647)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to PS. (CVE-2016-0648)

  - Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x     before 10.0.25 and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to     InnoDB. (CVE-2016-0655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

mariadb was updated to version 10.0.25 to fix 25 security issues.

These security issues were fixed :

  - CVE-2016-0505: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Options (bsc#980904).

  - CVE-2016-0546: Unspecified vulnerability allowed local     users to affect confidentiality, integrity, and     availability via unknown vectors related to Client     (bsc#980904).

  - CVE-2016-0596: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0597: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0598: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0600: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to InnoDB (bsc#980904).

  - CVE-2016-0606: Unspecified vulnerability allowed remote     authenticated users to affect integrity via unknown     vectors related to encryption (bsc#980904).

  - CVE-2016-0608: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to UDF (bsc#980904).

  - CVE-2016-0609: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to privileges (bsc#980904).

  - CVE-2016-0616: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0640: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0641: Unspecified vulnerability allowed local     users to affect confidentiality and availability via     vectors related to MyISAM (bsc#980904).

  - CVE-2016-0642: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to Federated (bsc#980904).

  - CVE-2016-0643: Unspecified vulnerability allowed local     users to affect confidentiality via vectors related to     DML (bsc#980904).

  - CVE-2016-0644: Unspecified vulnerability allowed local     users to affect availability via vectors related to DDL     (bsc#980904).

  - CVE-2016-0646: Unspecified vulnerability allowed local     users to affect availability via vectors related to DML     (bsc#980904).

  - CVE-2016-0647: Unspecified vulnerability allowed local     users to affect availability via vectors related to FTS     (bsc#980904).

  - CVE-2016-0648: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0649: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0650: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Replication (bsc#980904).

  - CVE-2016-0651: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Optimizer (bsc#980904).

  - CVE-2016-0655: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-0666: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Security: Privileges (bsc#980904).

  - CVE-2016-0668: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-2047: The ssl_verify_server_cert function in     sql-common/client.c did not properly verify that the     server hostname matches a domain name in the subject's     Common Name (CN) or subjectAltName field of the X.509     certificate, which allowed man-in-the-middle attackers     to spoof SSL servers via a '/CN=' string in a field in a     certificate, as demonstrated by     '/OU=/CN=bar.com/CN=foo.com (bsc#963806).

These non-security issues were fixed :

  - bsc#970295: Fix the leftovers of 'logrotate.d/mysql'     string in the logrotate error message. Occurrences of     this string were changed to 'logrotate.d/mariadb'

  - bsc#963810: Add 'log-error' and 'secure-file-priv'     configuration options

  - add '/etc/my.cnf.d/error_log.conf' that specifies     'log-error = /var/log/mysql/mysqld.log'. If no path is     set, the error log is written to     '/var/lib/mysql/$HOSTNAME.err', which is not picked up     by logrotate.

  - add '/etc/my.cnf.d/secure_file_priv.conf' which     specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD     FILE()' will only work with files in the directory     specified by 'secure-file-priv' option     (='/var/lib/mysql-files').

  - Temporarily disable OQGraph. It seems to need the boost     library with the version not earlier than 1.40 and not     later than 1.55 (MDEV-9479)

  - boo#979524: Don't remove HandlerSocket plugin 

  - boo#970287: Add 'BuildRequires: jemalloc-devel' in order     to allow enabling of the TokuDB plugin 

  - run 'usermod -g mysql mysql' only if mysql user is not     in mysql group. Run 'usermod -s /bin/false/ mysql' only     if mysql user doesn't have '/bin/false' shell set.

  - Re-enable profiling support

The version of MySQL running on the remote host is 5.7.x prior to 5.7.12. It is, therefore, affected by multiple vulnerabilities :

  - A cipher algorithm downgrade vulnerability exists in the     bundled version of OpenSSL due to a flaw that is     triggered when handling cipher negotiation. A remote     attacker can exploit this to negotiate SSLv2 ciphers and     complete SSLv2 handshakes even if all SSLv2 ciphers have     been disabled on the server. Note that this     vulnerability only exists if the SSL_OP_NO_SSLv2 option     has not been disabled. (CVE-2015-3197)

  - An unspecified flaw exists in the Pluggable     Authentication subcomponent that allows an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-0639)

  - An unspecified flaw exists in the Federated subcomponent     that allows an authenticated, remote attacker to impact     integrity and availability. (CVE-2016-0642)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to disclose     sensitive information. (CVE-2016-0643)

  - An unspecified flaw exists in the FTS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0647)

  - An unspecified flaw exists in the PS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0647)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0655)

  - An unspecified flaw exists in the JSON subcomponent that     allows an authenticated, remote attacker to disclose     sensitive information. (CVE-2016-0657)

  - An unspecified flaw exists in the Optimizer subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0659)

  - An unspecified flaw exists in the Partition subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0662)

  - An unspecified flaw exists in the Security: Privileges     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0666)

  - An unspecified flaw exists in the Locking subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0667)

  - A key disclosure vulnerability exists in the bundled     version of OpenSSL due to improper handling of     cache-bank conflicts on the Intel Sandy-bridge     microarchitecture. An attacker can exploit this to gain     access to RSA key information. (CVE-2016-0702)

  - A double-free error exists in the bundled version of     OpenSSL due to improper validation of user-supplied     input when parsing malformed DSA private keys. A remote     attacker can exploit this to corrupt memory, resulting     in a denial of service condition or the execution of     arbitrary code. (CVE-2016-0705)

  - A NULL pointer dereference flaw exists in the bundled     version of OpenSSL in the BN_hex2bn() and BN_dec2bn()     functions. A remote attacker can exploit this to trigger     a heap corruption, resulting in the execution of     arbitrary code. (CVE-2016-0797)

  - A denial of service vulnerability exists in the bundled     version of OpenSSL due to improper handling of invalid     usernames. A remote attacker can exploit this, via a     specially crafted username, to leak 300 bytes of memory     per connection, exhausting available memory resources.
    (CVE-2016-0798)

  - Multiple memory corruption issues exist in the bundled     version of OpenSSL that allow a remote attacker to cause     a denial of service condition or the execution of     arbitrary code. (CVE-2016-0799)

  - A flaw exists in the bundled version of OpenSSL that     allows a cross-protocol Bleichenbacher padding oracle     attack known as DROWN (Decrypting RSA with Obsolete and     Weakened eNcryption). This vulnerability exists due to a     flaw in the Secure Sockets Layer Version 2 (SSLv2)     implementation, and it allows captured TLS traffic to be     decrypted. A man-in-the-middle attacker can exploit this     to decrypt the TLS connection by utilizing previously     captured traffic and weak cryptography along with a     series of specially crafted connections to an SSLv2     server that uses the same private key. (CVE-2016-0800)

  - A man-in-the-middle spoofing vulnerability exists due to     the server hostname not being verified to match a domain     name in the Subject's Common Name (CN) or SubjectAltName     field of the X.509 certificate. A man-in-the-middle     attacker can exploit this, by spoofing the TLS/SSL     server via a certificate that appears valid, to disclose     sensitive information or manipulate transmitted data.
    (CVE-2016-2047)

  - An unspecified flaw exists in the Optimizer subcomponent     that allow an authenticated, remote attacker to cause a     denial of service condition. (CVE-2017-10378)

  - A flaw exists related to certificate validation due to     the server hostname not being verified to match a domain     name in the X.509 certificate. A man-in-the-middle     attacker can exploit this, by spoofing the TLS/SSL     server via a certificate that appears valid, to disclose     sensitive information or manipulate data.

  - An integer overflow condition exists that is triggered     due to improper validation of user-supplied input when     processing client handshakes. An authenticated, remote     attacker can exploit this to cause the server to exit,     resulting in a denial of service condition.

  - An information disclosure vulnerability exists due to     overly verbose error messages returning part of the SQL     statement that produced them. An authenticated, remote     attacker can exploit this to disclose sensitive     information.

  - A flaw exists in InnoDB that is triggered during the     handling of an ALTER TABLE or ADD COLUMN operation on a     table with virtual columns. An authenticated, remote     attacker can exploit this to crash the server, resulting     in a denial of service condition.

Oracle reports reports :

Critical Patch Update contains 31 new security fixes for Oracle MySQL 5.5.48, 5.6.29, 5.7.11 and earlier

The version of MariaDB installed on the remote host is prior to 5.5.49. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.49 advisory.

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to     affect confidentiality via vectors related to Server: Connection. (CVE-2016-5444)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     confidentiality via vectors related to DML. (CVE-2016-0643)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to FTS. (CVE-2016-0647)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to PS. (CVE-2016-0648)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to Security: Privileges. (CVE-2016-0666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to latest upstream release. Also fixes CVE-2016-0705, CVE-2016-0639, CVE-2016-2047, CVE-2016-0647, CVE-2016-0648, CVE-2016-0666, CVE-2016-0642, CVE-2016-0655, CVE-2016-0643

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to UDF. (CVE-2016-0608)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to privileges. (CVE-2016-0609)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Options. (CVE-2016-0505)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0600)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0616)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption. (CVE-2016-3452)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DDL.
(CVE-2016-0644)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser. (CVE-2016-3477)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0596)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0597)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect integrity and availability via vectors related to DML. (CVE-2016-0640)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. (CVE-2016-3521)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect integrity and availability via vectors related to Federated. (CVE-2016-0642)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect confidentiality via vectors related to DML.
(CVE-2016-0643)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to Security:
Privileges. (CVE-2016-0666)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
(CVE-2016-0651)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to Replication.
(CVE-2016-0650)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0598)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to PS.
(CVE-2016-0649)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote administrators to affect availability via vectors related to Server: RBR. (CVE-2016-5440)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows remote attackers to affect confidentiality via vectors related to Server: Connection. (CVE-2016-5444)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect integrity via unknown vectors related to encryption. (CVE-2016-0606)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to PS.
(CVE-2016-0648)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect availability via vectors related to DML.
(CVE-2016-0646)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. (CVE-2016-0546)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier allows local users to affect availability via vectors related to FTS.
(CVE-2016-0647)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier allows remote authenticated users to affect availability via vectors related to Server: DML. (CVE-2016-3615)

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier allows local users to affect confidentiality and availability via vectors related to MyISAM. (CVE-2016-0641)

mariadb was updated to version 10.0.25 to fix 25 security issues.

These security issues were fixed :

  - CVE-2016-0505: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Options (bsc#980904).

  - CVE-2016-0546: Unspecified vulnerability allowed local     users to affect confidentiality, integrity, and     availability via unknown vectors related to Client     (bsc#980904).

  - CVE-2016-0596: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0597: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0598: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0600: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to InnoDB (bsc#980904).

  - CVE-2016-0606: Unspecified vulnerability allowed remote     authenticated users to affect integrity via unknown     vectors related to encryption (bsc#980904).

  - CVE-2016-0608: Unspecified vulnerability allowed remote     authenticated users to affect availability via vectors     related to UDF (bsc#980904).

  - CVE-2016-0609: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to privileges (bsc#980904).

  - CVE-2016-0616: Unspecified vulnerability allowed remote     authenticated users to affect availability via unknown     vectors related to Optimizer (bsc#980904).

  - CVE-2016-0640: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to DML (bsc#980904).

  - CVE-2016-0641: Unspecified vulnerability allowed local     users to affect confidentiality and availability via     vectors related to MyISAM (bsc#980904).

  - CVE-2016-0642: Unspecified vulnerability allowed local     users to affect integrity and availability via vectors     related to Federated (bsc#980904).

  - CVE-2016-0643: Unspecified vulnerability allowed local     users to affect confidentiality via vectors related to     DML (bsc#980904).

  - CVE-2016-0644: Unspecified vulnerability allowed local     users to affect availability via vectors related to DDL     (bsc#980904).

  - CVE-2016-0646: Unspecified vulnerability allowed local     users to affect availability via vectors related to DML     (bsc#980904).

  - CVE-2016-0647: Unspecified vulnerability allowed local     users to affect availability via vectors related to FTS     (bsc#980904).

  - CVE-2016-0648: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0649: Unspecified vulnerability allowed local     users to affect availability via vectors related to PS     (bsc#980904).

  - CVE-2016-0650: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Replication (bsc#980904).

  - CVE-2016-0651: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Optimizer (bsc#980904).

  - CVE-2016-0655: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-0666: Unspecified vulnerability allowed local     users to affect availability via vectors related to     Security: Privileges (bsc#980904).

  - CVE-2016-0668: Unspecified vulnerability allowed local     users to affect availability via vectors related to     InnoDB (bsc#980904).

  - CVE-2016-2047: The ssl_verify_server_cert function in     sql-common/client.c did not properly verify that the     server hostname matches a domain name in the subject's     Common Name (CN) or subjectAltName field of the X.509     certificate, which allowed man-in-the-middle attackers     to spoof SSL servers via a '/CN=' string in a field in a     certificate, as demonstrated by     '/OU=/CN=bar.com/CN=foo.com (bsc#963806).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
99798	EulerOS 2.0 SP1 : mariadb (EulerOS-SA-2016-1035)	Nessus	Huawei Local Security Checks	5/1/2017	12/22/2025	high
91765	MariaDB 10.0.0 < 10.0.25 Multiple Vulnerabilities	Nessus	Databases	6/22/2016	1/29/2026	low
91794	openSUSE Security Update : mariadb (openSUSE-2016-761)	Nessus	SuSE Local Security Checks	6/24/2016	1/19/2021	medium
90684	MySQL 5.7.x < 5.7.12 Multiple Vulnerabilities (DROWN)	Nessus	Databases	4/22/2016	11/19/2019	critical
90847	FreeBSD : MySQL -- multiple vulnerabilities (8c2b2f11-0ebe-11e6-b55e-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	5/3/2016	1/4/2021	critical
93616	MariaDB 5.5.0 < 5.5.49 Multiple Vulnerabilities	Nessus	Databases	9/21/2016	1/29/2026	low
92116	Fedora 23 : community-mysql (2016-7c48036d73)	Nessus	Fedora Local Security Checks	7/14/2016	2/2/2026	critical
93016	Amazon Linux AMI : mysql55 (ALAS-2016-738)	Nessus	Amazon Linux Local Security Checks	8/18/2016	1/28/2026	high
93159	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:1620-1)	Nessus	SuSE Local Security Checks	8/29/2016	1/27/2026	medium

Detections

Analytics

Plugins Search

high

low

medium

critical

critical

low

critical

high

medium