[gentoo-announce] [ GLSA 201702-17 ] MySQL: Multiple vulnerabilities - gentoo-announce

From:	Thomas Deutschmann <whissi@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201702-17 ] MySQL: Multiple vulnerabilities
Date:	Mon, 20 Feb 2017 23:43:15
Message-Id:	`8ce0ae68-8e95-559c-e100-0d3c1e00febf@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201702-17

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: High

8

    Title: MySQL: Multiple vulnerabilities

9

     Date: February 20, 2017

10

     Bugs: #606254

11

       ID: 201702-17

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in MySQL, the worst of which

19

could lead to privilege escalation.

20

21

Background

22

==========

23

24

MySQL is a popular multi-threaded, multi-user SQL server. MariaDB is an

25

enhanced, drop-in replacement for MySQL.

26

27

Affected packages

28

=================

29

30

    -------------------------------------------------------------------

31

     Package              /     Vulnerable     /            Unaffected

32

    -------------------------------------------------------------------

33

  1  dev-db/mysql                 < 5.6.35                  >= 5.6.35

34

35

Description

36

===========

37

38

Multiple vulnerabilities have been discovered in MySQL. Please review

39

the CVE identifiers referenced below for details.

40

41

Impact

42

======

43

44

An attacker could possibly escalate privileges, gain access to critical

45

data or complete access to all MySQL server accessible data, or cause a

46

Denial of Service condition via unspecified vectors.

47

48

Workaround

49

==========

50

51

There is no known workaround at this time.

52

53

Resolution

54

==========

55

56

All MySQL users should upgrade to the latest version:

57

58

  # emerge --sync

59

  # emerge --ask --oneshot --verbose ">=dev-db/mysql-5.6.35"

60

61

References

62

==========

63

64

[  1 ] CVE-2016-8318

65

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8318

66

[  2 ] CVE-2016-8327

67

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8327

68

[  3 ] CVE-2017-3238

69

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3238

70

[  4 ] CVE-2017-3243

71

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3243

72

[  5 ] CVE-2017-3244

73

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3244

74

[  6 ] CVE-2017-3251

75

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3251

76

[  7 ] CVE-2017-3256

77

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3256

78

[  8 ] CVE-2017-3257

79

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3257

80

[  9 ] CVE-2017-3258

81

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3258

82

[ 10 ] CVE-2017-3265

83

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3265

84

[ 11 ] CVE-2017-3273

85

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3273

86

[ 12 ] CVE-2017-3291

87

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3291

88

[ 13 ] CVE-2017-3312

89

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3312

90

[ 14 ] CVE-2017-3313

91

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3313

92

[ 15 ] CVE-2017-3317

93

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3317

94

[ 16 ] CVE-2017-3318

95

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3318

96

[ 17 ] CVE-2017-3319

97

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3319

98

[ 18 ] CVE-2017-3320

99

       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3320

100

[ 19 ] Oracle Critical Patch Update Advisory - January 2017

101

102

https://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL

103

104

Availability

105

============

106

107

This GLSA and any updates to it are available for viewing at

108

the Gentoo Security Website:

109

110

 https://security.gentoo.org/glsa/201702-17

111

112

Concerns?

113

=========

114

115

Security is a primary focus of Gentoo Linux and ensuring the

116

confidentiality and security of our users' machines is of utmost

117

importance to us. Any security concerns should be addressed to

118

security@g.o or alternatively, you may file a bug at

119

https://bugs.gentoo.org.

120

121

License

122

=======

123

124

Copyright 2017 Gentoo Foundation, Inc; referenced text

125

belongs to its owner(s).

126

127

The contents of this document are licensed under the

128

Creative Commons - Attribution / Share Alike license.

129

130

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201702-17
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: High
8	Title: MySQL: Multiple vulnerabilities
9	Date: February 20, 2017
10	Bugs: #606254
11	ID: 201702-17
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in MySQL, the worst of which
19	could lead to privilege escalation.
20
21	Background
22	==========
23
24	MySQL is a popular multi-threaded, multi-user SQL server. MariaDB is an
25	enhanced, drop-in replacement for MySQL.
26
27	Affected packages
28	=================
29
30	-------------------------------------------------------------------
31	Package / Vulnerable / Unaffected
32	-------------------------------------------------------------------
33	1 dev-db/mysql < 5.6.35 >= 5.6.35
34
35	Description
36	===========
37
38	Multiple vulnerabilities have been discovered in MySQL. Please review
39	the CVE identifiers referenced below for details.
40
41	Impact
42	======
43
44	An attacker could possibly escalate privileges, gain access to critical
45	data or complete access to all MySQL server accessible data, or cause a
46	Denial of Service condition via unspecified vectors.
47
48	Workaround
49	==========
50
51	There is no known workaround at this time.
52
53	Resolution
54	==========
55
56	All MySQL users should upgrade to the latest version:
57
58	# emerge --sync
59	# emerge --ask --oneshot --verbose ">=dev-db/mysql-5.6.35"
60
61	References
62	==========
63
64	[ 1 ] CVE-2016-8318
65	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8318
66	[ 2 ] CVE-2016-8327
67	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8327
68	[ 3 ] CVE-2017-3238
69	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3238
70	[ 4 ] CVE-2017-3243
71	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3243
72	[ 5 ] CVE-2017-3244
73	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3244
74	[ 6 ] CVE-2017-3251
75	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3251
76	[ 7 ] CVE-2017-3256
77	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3256
78	[ 8 ] CVE-2017-3257
79	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3257
80	[ 9 ] CVE-2017-3258
81	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3258
82	[ 10 ] CVE-2017-3265
83	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3265
84	[ 11 ] CVE-2017-3273
85	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3273
86	[ 12 ] CVE-2017-3291
87	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3291
88	[ 13 ] CVE-2017-3312
89	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3312
90	[ 14 ] CVE-2017-3313
91	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3313
92	[ 15 ] CVE-2017-3317
93	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3317
94	[ 16 ] CVE-2017-3318
95	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3318
96	[ 17 ] CVE-2017-3319
97	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3319
98	[ 18 ] CVE-2017-3320
99	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3320
100	[ 19 ] Oracle Critical Patch Update Advisory - January 2017
101
102	https://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL
103
104	Availability
105	============
106
107	This GLSA and any updates to it are available for viewing at
108	the Gentoo Security Website:
109
110	https://security.gentoo.org/glsa/201702-17
111
112	Concerns?
113	=========
114
115	Security is a primary focus of Gentoo Linux and ensuring the
116	confidentiality and security of our users' machines is of utmost
117	importance to us. Any security concerns should be addressed to
118	security@g.o or alternatively, you may file a bug at
119	https://bugs.gentoo.org.
120
121	License
122	=======
123
124	Copyright 2017 Gentoo Foundation, Inc; referenced text
125	belongs to its owner(s).
126
127	The contents of this document are licensed under the
128	Creative Commons - Attribution / Share Alike license.
129
130	http://creativecommons.org/licenses/by-sa/2.5