Red Hat Security Advisory

RHSA-2017:2787

rh-mysql56-mysql security and bug fix update

Released 2017-09-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-mysql56-mysql-5.6.37-5.el6, rh-mysql56-mysql-bench-5.6.37-5.el6, rh-mysql56-mysql-common-5.6.37-5.el6 +5
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-mysql56-mysql-5.6.37-5.el7, rh-mysql56-mysql-bench-5.6.37-5.el7, rh-mysql56-mysql-common-5.6.37-5.el7 +5
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-mysql56-mysql-5.6.37-5.el6, rh-mysql56-mysql-bench-5.6.37-5.el6, rh-mysql56-mysql-common-5.6.37-5.el6 +5
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-mysql56-mysql-5.6.37-5.el7, rh-mysql56-mysql-bench-5.6.37-5.el7, rh-mysql56-mysql-common-5.6.37-5.el7 +5
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-mysql56-mysql-5.6.37-5.el6, rh-mysql56-mysql-bench-5.6.37-5.el6, rh-mysql56-mysql-common-5.6.37-5.el6 +5
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-mysql56-mysql-5.6.37-5.el7, rh-mysql56-mysql-bench-5.6.37-5.el7, rh-mysql56-mysql-common-5.6.37-5.el7 +5

Fixes 36 records

TI-2017-02794 CVE-2017-3599 · GHSA-292g-7jqj-vpqr

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

HIGH 82

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth).

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.9003 Published 2017-04-24 Fixed CWE-190

TI-2017-02502 CVE-2017-3302 · GHSA-77pr-jpcv-9w4v

Use after free in Oracle MySQL Server

MEDIUM 47

Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04945 Published 2017-02-12 Partial fix CWE-416

TI-2017-02647 CVE-2017-3450 · GHSA-ggfr-xfv3-69h3

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

MEDIUM 46

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached).

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04279 Published 2017-04-24 Fixed

TI-2017-02509 CVE-2017-3309 · GHSA-w87m-w678-grxc

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 39

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.03103 Published 2017-04-24 Partial fix

TI-2017-02508 CVE-2017-3308 · GHSA-3pr9-66rq-v5rm

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 39

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.03103 Published 2017-04-24 Partial fix

TI-2017-02438 CVE-2017-3238 · GHSA-6hx8-rgxq-6pp6

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 37

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04792 Published 2017-01-27 Partial fix

TI-2017-02795 CVE-2017-3600 · GHSA-w9mm-wmr9-fjjp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client…

LOW 36

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump).

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.02662 Published 2017-04-24 Partial fix

TI-2017-02444 CVE-2017-3244 · GHSA-qwx7-fp8p-2j3c

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 35

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03707 Published 2017-01-27 Partial fix

TI-2017-02826 CVE-2017-3634 · GHSA-c58w-f75c-4qwf

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02989 Published 2017-08-08 Fixed

TI-2017-02825 CVE-2017-3633 · GHSA-xp8h-g29p-cq44

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Memcached).

CVSS 3.0MEDIUM 6.5 Network No auth No interaction EPSS 0.02952 Published 2017-08-08 Fixed

TI-2017-02650 CVE-2017-3453 · GHSA-7967-57vf-g674

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03103 Published 2017-04-24 Partial fix

TI-2017-02473 CVE-2017-3273 · GHSA-ccg6-qw5v-4qc5

Improper input validation in Oracle MySQL Server

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03086 Published 2017-01-27 Fixed CWE-20

TI-2017-02458 CVE-2017-3258 · GHSA-r23c-pfc8-wx95

Improper input validation in Oracle MySQL Server

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03103 Published 2017-01-27 Partial fix CWE-20

TI-2017-02457 CVE-2017-3257 · GHSA-4vfm-qwr5-7w89

Improper privilege management in Oracle MySQL Server

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0257 Published 2017-01-27 Fixed CWE-269

TI-2017-02649 CVE-2017-3452 · GHSA-vvr7-h5qq-ccf3

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 33

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02335 Published 2017-04-24 Fixed

TI-2017-02512 CVE-2017-3312 · GHSA-52jx-rfc6-628g

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 32

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging).

CVSS 3.1MEDIUM 6.7 Local Low privileges User interaction EPSS 0.00446 Published 2017-01-27 Partial fix

TI-2017-02491 CVE-2017-3291 · GHSA-q85r-m5q6-9v4f

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 30

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging).

CVSS 3.1MEDIUM 6.3 Local High privileges User interaction EPSS 0.00438 Published 2017-01-27 Partial fix

TI-2017-02833 CVE-2017-3641 · GHSA-pvvc-fmf7-5pf7

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.03225 Published 2017-08-08 Partial fix

TI-2017-02660 CVE-2017-3463 · GHSA-wgm9-29x7-w93p

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges).

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.02829 Published 2017-04-24 Partial fix

TI-2017-02659 CVE-2017-3462 · GHSA-g978-qc54-9v6h

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges).

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.02853 Published 2017-04-24 Partial fix

TI-2017-02658 CVE-2017-3461 · GHSA-4gw5-48mq-7wxw

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges).

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.02829 Published 2017-04-24 Partial fix

TI-2017-02653 CVE-2017-3456 · GHSA-r9xj-fg4h-7gwp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02989 Published 2017-04-24 Partial fix

TI-2017-02465 CVE-2017-3265 · GHSA-x6m4-gw2j-999q

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging).

CVSS 3.1MEDIUM 5.6 Local High privileges User interaction EPSS 0.0136 Published 2017-01-27 Partial fix

TI-2017-02505 CVE-2017-3305 · GHSA-7568-gxg7-r8h9

Cleartext transmission of sensitive information in Oracle MySQL Server

LOW 27

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API).

CVSS 3.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01361 Published 2017-04-24 Fixed CWE-319

TI-2017-02840 CVE-2017-3648 · GHSA-vc7g-w445-552w

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 26

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets).

CVSS 3.0MEDIUM 4.4 Network High privileges No interaction EPSS 0.02763 Published 2017-08-08 Partial fix

TI-2017-02839 CVE-2017-3647 · GHSA-8cpm-vjh8-pmw3

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 26

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication).

CVSS 3.0MEDIUM 4.4 Network High privileges No interaction EPSS 0.02808 Published 2017-08-08 Fixed

TI-2017-02841 CVE-2017-3649 · GHSA-f5ch-9qq8-6633

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 25

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication).

CVSS 3.0MEDIUM 4.4 Network High privileges No interaction EPSS 0.02697 Published 2017-08-08 Fixed

TI-2016-06844 CVE-2016-8327 · GHSA-6v49-7fm7-r439

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 25

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication).

CVSS 3.0MEDIUM 4.4 Network High privileges No interaction EPSS 0.02429 Published 2017-01-27 Fixed

TI-2017-02843 CVE-2017-3651 · GHSA-h2r9-q8w8-hpcr

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client…

LOW 24

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0215 Published 2017-08-08 Partial fix

TI-2017-02828 CVE-2017-3636 · GHSA-c28x-42jj-83gc

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client…

LOW 24

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs).

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00438 Published 2017-08-08 Partial fix

TI-2017-02661 CVE-2017-3464 · GHSA-4xm4-j6r9-v8m3

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

LOW 24

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0215 Published 2017-04-24 Partial fix

TI-2017-02844 CVE-2017-3652 · GHSA-wpv7-j2jg-64jq

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

LOW 23

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.0MEDIUM 4.2 Network Low privileges No interaction EPSS 0.01543 Published 2017-08-08 Partial fix

TI-2017-02513 CVE-2017-3313 · GHSA-9gmr-x7pv-f3xp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 22

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM).

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00422 Published 2017-01-27 Partial fix

TI-2017-02845 CVE-2017-3653 · GHSA-fhc7-95hq-9w87

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

LOW 19

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.01887 Published 2017-08-08 Partial fix

TI-2017-02518 CVE-2017-3318 · GHSA-qwwx-r45m-fccp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error…

LOW 19

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error Handling).

CVSS 3.1MEDIUM 4.0 Local High privileges User interaction EPSS 0.00452 Published 2017-01-27 Partial fix

TI-2017-02517 CVE-2017-3317 · GHSA-6x64-rm6c-4p72

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging).

LOW 19

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging).

CVSS 3.1MEDIUM 4.0 Local High privileges User interaction EPSS 0.004 Published 2017-01-27 Partial fix