CVE-2017-3265

mysql: unsafe chmod/chown use in init script (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 5.6 (Confidentiality and Availability impacts).

CVSS 3.1 · 5.6 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2016-2518

ntp: out-of-bounds references on crafted packet

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

CVSS 3.1 · 5.3 Medium EPSS 15.1% KEV · Not listed

Vendors

Debian Freebsd Netapp and 4 more

Products

Debian Linux Freebsd Clustered Data Ontap and 17 more

CVE-2017-3291

mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3313

mysql: Server: MyISAM unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS v3.0 Base Score 4.7 (Confidentiality impacts).

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Mariadb and 2 more

Products

Ubuntu Linux Debian Linux Mariadb and 9 more

CVE-2017-3600

mysql: Incorrect input validation allowing code execution via mysqldump

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. Note: CVE-2017-3600 is equivalent to CVE-2016-5483. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 6.6 Medium EPSS 2.7% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2017-3308

mysql: Server: DML unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).

CVSS 3.1 · 7.7 High EPSS 3.1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 8 more

CVE-2018-1000156

patch: Malicious patch files cause ed to execute arbitrary commands

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.

CVSS 3.0 · 7.8 High EPSS 5.3% KEV · Not listed

Vendors

Canonical Debian Gnu and 1 more

Products

Ubuntu Linux Debian Linux Patch and 11 more

CVE-2016-0758

kernel: tags with indefinite length can corrupt pointers in asn1_find_indefinite_length()

Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 9 more

CVE-2014-2430

mysql: unspecified DoS related to Performance Schema (CPU April 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema.

CVSS 2.0 · 3.5 Low EPSS 3.3% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Solaris and 8 more

CVE-2016-0749

spice: heap-based memory corruption within smartcard handling

The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.

CVSS 3.0 · 9.8 Critical EPSS 8.5% KEV · Not listed

Vendors

Debian Microsoft Opensuse and 2 more

Products

Debian Linux Windows Leap and 9 more

CVE-2016-0695

OpenJDK: insufficient DSA key parameters checks (Security, 8138593)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed

Vendors

Oracle Redhat

Products

Jdk Jre Jrockit and 11 more

CVE-2014-2419

mysql: unspecified DoS related to Partition (CPU April 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition.

CVSS 2.0 · 4.0 Medium EPSS 3.7% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Solaris and 8 more

CVE-2016-0651

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Mariadb Opensuse Oracle and 2 more

Products

Mariadb Leap Opensuse and 14 more

CVE-2016-0642

mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.

CVSS 3.1 · 4.7 Medium EPSS 1.2% KEV · Not listed

Vendors

Canonical Debian Mariadb and 4 more

Products

Ubuntu Linux Debian Linux Mariadb and 16 more

CVE-2016-0616

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 13 more

CVE-2016-0609

mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges.

CVSS 2.0 · 1.7 Low EPSS 4.4% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0608

mysql: unspecified vulnerability in subcomponent: Server: UDF (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to UDF.

CVSS 2.0 · 3.5 Low EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0606

mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect integrity via unknown vectors related to encryption.

CVSS 2.0 · 3.5 Low EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0600

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

CVSS 2.0 · 3.5 Low EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more

CVE-2016-0598

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

CVSS 2.0 · 3.5 Low EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Mariadb and 3 more

Products

Ubuntu Linux Debian Linux Mariadb and 14 more