CVE-2016-8289

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows local users to affect integrity and availability via vectors related to Server: InnoDB.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Mysql

CVE-2016-8288

mysql: unspecified vulnerability in subcomponent: Server: InnoDB Plugin (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin.

CVSS 3.0 · 3.1 Low EPSS 1.6% KEV · Not listed

Vendors

Oracle Redhat

Products

Mysql Rhel Software Collections

CVE-2016-8287

mysql: unspecified vulnerability in subcomponent: Server: Replication (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Replication.

CVSS 3.0 · 4.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Oracle

Products

Mysql

CVE-2016-8286

mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges.

CVSS 3.0 · 3.1 Low EPSS 2.2% KEV · Not listed

Vendors

Oracle

Products

Mysql

CVE-2016-8284

mysql: unspecified vulnerability in subcomponent: Server: Replication (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication.

CVSS 3.0 · 1.8 Low EPSS < 1% KEV · Not listed

Vendors

Oracle Redhat

Products

Mysql Rhel Software Collections

CVE-2016-8283

mysql: unspecified vulnerability in subcomponent: Server: Types (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types.

CVSS 3.0 · 4.3 Medium EPSS 7.0% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 1 more

CVE-2016-7440

yaSSL: AES key leak via cache-bank timing side channel attack

The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mariadb Oracle and 1 more

Products

Debian Linux Mariadb Mysql and 1 more

CVE-2016-6664

mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016)

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.

CVSS 3.1 · 7.0 High EPSS 3.0% KEV · Not listed

Vendors

Mariadb Oracle Percona and 1 more

Products

Mariadb Mysql Percona Server and 3 more

CVE-2016-6663

mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016)

Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.

CVSS 3.0 · 7.0 High EPSS 4.3% KEV · Not listed

Vendors

Mariadb Oracle Percona and 1 more

Products

Mariadb Mysql Percona Server and 3 more

CVE-2016-6662

mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

CVSS 3.0 · 9.8 Critical EPSS 67.7% KEV · Not listed

Vendors

Debian Mariadb Oracle and 2 more

Products

Debian Linux Mariadb Mysql and 10 more

CVE-2016-5635

mysql: unspecified vulnerability in subcomponent: Server: Security: Audit (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit.

CVSS 3.1 · 4.9 Medium EPSS 2.5% KEV · Not listed

Vendors

Oracle

Products

Mysql

CVE-2016-5634

mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to RBR.

CVSS 3.1 · 4.9 Medium EPSS 2.5% KEV · Not listed

Vendors

Oracle

Products

Mysql

CVE-2016-5633

mysql: unspecified vulnerability in subcomponent: Server: Performance Schema (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-8290.

CVSS 3.1 · 4.9 Medium EPSS 2.5% KEV · Not listed

Vendors

Oracle

Products

Mysql

CVE-2016-5632

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Optimizer.

CVSS 3.1 · 4.9 Medium EPSS 2.5% KEV · Not listed

Vendors

Oracle

Products

Mysql

CVE-2016-5631

mysql: unspecified vulnerability in subcomponent: Server: Memcached (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Memcached.

CVSS 3.1 · 4.9 Medium EPSS 2.5% KEV · Not listed

Vendors

Oracle

Products

Mysql

CVE-2016-5630

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

CVSS 3.1 · 4.9 Medium EPSS 2.0% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Rhel Software Collections

CVE-2016-5629

mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Federated.

CVSS 3.1 · 4.9 Medium EPSS 3.3% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 7 more

CVE-2016-5628

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: DML.

CVSS 3.1 · 4.9 Medium EPSS 3.1% KEV · Not listed

Vendors

Oracle

Products

Mysql

CVE-2016-5627

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to Server: InnoDB.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed

Vendors

Oracle Redhat

Products

Mysql Rhel Software Collections

CVE-2016-5626

mysql: unspecified vulnerability in subcomponent: Server: GIS (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS.

CVSS 3.1 · 6.5 Medium EPSS 6.3% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 5 more