CVSS: 7.8EPSS: 11%CPEs: 12EXPL: 3CVE-2016-6664 – MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'root' System User Privilege Escalation
https://notcve.org/view.php?id=CVE-2016-6664
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files. mysqld_safe en Oracle MySQL hasta la versión 5.5.51, 5.6.x hasta la versión 5.6.32 y 5.7.x hasta la versión 5.7.14; MariaDB; Percona Server en versiones anteriores a 5.5.51-38.2, 5.6.x en versiones anteriores a 5.6.32-78-1 y 5.7.x en versiones anteriores a 5.7.14-8 y Percona XtraDB Cluster en versiones anteriores a 5.5.41-37.0, 5.6.x en versiones anteriores a 5.6.32-25.17 y 5.7.x en versiones anteriores a 5.7.14-26.17, cuando usa un inicio de sesión basada en archivo, permite a usuarios locales con acceso a la cuenta mysql obtener privilegios de root a través de un ataque de enlace simbólico en errores de acceso y posiblemente otros archivos. A flaw was found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use this flaw to escalate their privileges to root. MySQL-based databases including MySQL, MariaDB and PerconaDB are affected by a privilege escalation vulnerability which can let attackers who have gained access to mysql system user to further escalate their privileges to root user allowing them to fully compromise the system. The vulnerability stems from unsafe file handling of error logs and other files. • https://www.exploit-db.com/exploits/40679 http://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html http://packetstormsecurity.com/files/139491/MySQL-MariaDB-PerconaDB-Root-Privilege-Escalation.html http://rhn.redhat.com/errata/RHSA-2016-2130.html http://rhn.redhat.com/errata/RHSA-2016-2749.html http://seclists.org/fulldisclosure/2016/Nov/4 http://www.debian.org/security/2017/dsa-3770 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722. • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.0EPSS: 0%CPEs: 13EXPL: 3CVE-2016-6663 – MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - 'mysql' System User Privilege Escalation / Race Condition
https://notcve.org/view.php?id=CVE-2016-6663
Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table. Condición de carrera en Oracle MySQL en versiones anteriores a 5.5.52, 5.6.x en versiones anteriores a 5.6.33, 5.7.x en versiones anteriores a 5.7.15 y 8.x en versiones anteriores a 8.0.1; MariaDB en versiones anteriores a 5.5.52, 10.0.x en versiones anteriores a 10.0.28 y 10.1.x en versiones anteriores a 10.1.18; Percona Server en versiones anteriores a 5.5.51-38.2, 5.6.x en versiones anteriores a 5.6.32-78-1 y 5.7.x en versiones anteriores a 5.7.14-8 y Percona XtraDB Cluster en versiones anteriores a 5.5.41-37.0, 5.6.x en versiones anteriores a 5.6.32-25.17 y 5.7.x en versiones anteriores a 5.7.14-26.17 permite a usuarios locales con ciertos permisos obtener privilegios aprovechando el uso de my_copystat por REPAIR TABLE para reparar una tabla MyISAM. A race condition was found in the way MySQL performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user. An independent research has revealed a race condition vulnerability which affects MySQL, MariaDB and PerconaDB databases. • https://www.exploit-db.com/exploits/40678 https://github.com/firebroo/CVE-2016-6663 http://rhn.redhat.com/errata/RHSA-2016-2130.html http://rhn.redhat.com/errata/RHSA-2016-2131.html http://rhn.redhat.com/errata/RHSA-2016-2595.html http://rhn.redhat.com/errata/RHSA-2016-2749.html http://rhn.redhat.com/errata/RHSA-2016-2927.html http://rhn.redhat.com/errata/RHSA-2016-2928.html http://rhn.redhat.com/errata/RHSA-2017-0184.html http://seclists.org/fulldisclosure • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2016-7440
https://notcve.org/view.php?id=CVE-2016-7440
The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences. La implementación de software C de AES Encryption and Decryption en wolfSSL (anterioremtne CyaSSL) en versiones anteriores a 3.9.10 hace más fácil para usuarios locales descubrir las claves AES aprovechando las diferencias de tiempo de banco del cachè. • http://www.debian.org/security/2016/dsa-3706 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.securityfocus.com/bid/93659 http://www.securitytracker.com/id/1037050 https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes https://wolfssl.com/wolfSSL/Blog/Entries/2016/9/26_wolfSSL_3.9.10_Vulnerability_Fixes.html •
CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2016-5626 – mysql: unspecified vulnerability in subcomponent: Server: GIS (CPU October 2016)
https://notcve.org/view.php?id=CVE-2016-5626
Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS. Vulnerabilidad no especificada en Oracle MySQL 5.5.51 y versiones anteriores, 5.6.32 y versiones anteriores y 5.7.14 y versiones anteriores permite a usuarios remotos autenticados afectar la disponibilidad a través de vectores relacionados con GIS. • http://rhn.redhat.com/errata/RHSA-2016-2130.html http://rhn.redhat.com/errata/RHSA-2016-2131.html http://rhn.redhat.com/errata/RHSA-2016-2595.html http://rhn.redhat.com/errata/RHSA-2016-2749.html http://rhn.redhat.com/errata/RHSA-2016-2927.html http://rhn.redhat.com/errata/RHSA-2016-2928.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.securityfocus.com/bid/93638 http://www.securitytracker.com/id/1037050 https://mariadb.co •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2016-8283 – mysql: unspecified vulnerability in subcomponent: Server: Types (CPU October 2016)
https://notcve.org/view.php?id=CVE-2016-8283
Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. Vulnerabilidad no especificada en Oracle MySQL 5.5.51 y versiones anteriores, 5.6.32 y versiones anteriores y 5.7.14 y versiones anteriores permite a usuarios remotos autenticados afectar la disponibilidad a través de vectores relacionados con Server: Types. • http://rhn.redhat.com/errata/RHSA-2016-2130.html http://rhn.redhat.com/errata/RHSA-2016-2131.html http://rhn.redhat.com/errata/RHSA-2016-2595.html http://rhn.redhat.com/errata/RHSA-2016-2749.html http://rhn.redhat.com/errata/RHSA-2016-2927.html http://rhn.redhat.com/errata/RHSA-2016-2928.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.securityfocus.com/bid/93737 http://www.securitytracker.com/id/1037050 https://mariadb.co •