ID CVE-2016-5630
Summary Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.
References
Vulnerable Configurations
  • MariaDB 10.0.0
    cpe:2.3:a:mariadb:mariadb:10.0.0
  • MariaDB 10.0.1
    cpe:2.3:a:mariadb:mariadb:10.0.1
  • MariaDB 10.0.2
    cpe:2.3:a:mariadb:mariadb:10.0.2
  • MariaDB 10.0.3
    cpe:2.3:a:mariadb:mariadb:10.0.3
  • MariaDB 10.0.4
    cpe:2.3:a:mariadb:mariadb:10.0.4
  • MariaDB 10.0.5
    cpe:2.3:a:mariadb:mariadb:10.0.5
  • MariaDB 10.0.6
    cpe:2.3:a:mariadb:mariadb:10.0.6
  • MariaDB 10.0.7
    cpe:2.3:a:mariadb:mariadb:10.0.7
  • MariaDB 10.0.8
    cpe:2.3:a:mariadb:mariadb:10.0.8
  • MariaDB 10.0.9
    cpe:2.3:a:mariadb:mariadb:10.0.9
  • MariaDB 10.0.10
    cpe:2.3:a:mariadb:mariadb:10.0.10
  • MariaDB 10.0.11
    cpe:2.3:a:mariadb:mariadb:10.0.11
  • MariaDB 10.0.12
    cpe:2.3:a:mariadb:mariadb:10.0.12
  • MariaDB 10.0.13
    cpe:2.3:a:mariadb:mariadb:10.0.13
  • MariaDB 10.0.14
    cpe:2.3:a:mariadb:mariadb:10.0.14
  • MariaDB 10.0.15
    cpe:2.3:a:mariadb:mariadb:10.0.15
  • MariaDB 10.0.16
    cpe:2.3:a:mariadb:mariadb:10.0.16
  • MariaDB 10.0.17
    cpe:2.3:a:mariadb:mariadb:10.0.17
  • MariaDB 10.0.18
    cpe:2.3:a:mariadb:mariadb:10.0.18
  • MariaDB 10.0.19
    cpe:2.3:a:mariadb:mariadb:10.0.19
  • MariaDB 10.0.20
    cpe:2.3:a:mariadb:mariadb:10.0.20
  • MariaDB 10.0.21
    cpe:2.3:a:mariadb:mariadb:10.0.21
  • MariaDB 10.0.22
    cpe:2.3:a:mariadb:mariadb:10.0.22
  • MariaDB 10.0.23
    cpe:2.3:a:mariadb:mariadb:10.0.23
  • MariaDB 10.0.24
    cpe:2.3:a:mariadb:mariadb:10.0.24
  • MariaDB 10.0.25
    cpe:2.3:a:mariadb:mariadb:10.0.25
  • MariaDB 10.0.26
    cpe:2.3:a:mariadb:mariadb:10.0.26
  • MariaDB 10.0.27
    cpe:2.3:a:mariadb:mariadb:10.0.27
CVSS
Base: 4.0 (as of 11-01-2017 - 13:19)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Databases
    NASL id MYSQL_5_7_14.NASL
    description The version of MySQL running on the remote host is 5.7.x prior to 5.7.14. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws exist in the InnoDB subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3495, CVE-2016-5627, CVE-2016-5630) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5612) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5628) - An unspecified flaw exists in the Memcached subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5631) - Multiple unspecified flaws exist in the Performance Schema subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5633, CVE-2016-8290) - An unspecified flaw exists in the RBR subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5634) - An unspecified flaw exists in the Security: Audit subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5635) - An unspecified flaw exists in the Replication subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-8284) - An unspecified flaw exists in the Replication subcomponent that allows a authenticated, remote attacker to cause a denial of service condition. (CVE-2016-8287) - An unspecified flaw exists in the InnoDB subcomponent that allows a local attacker to impact integrity and availability. (CVE-2016-8289) - A denial of service vulnerability exists in InnoDB when selecting full-text index information schema tables for a deleted table. An authenticated, remote attacker can exploit this to cause a segmentation fault. - A denial of service vulnerability exists in InnoDB when handling ALTER TABLE operations on tables that have an indexed virtual column. An authenticated, remote attacker can exploit this to cause an assertion failure, resulting in a server crash. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 93004
    published 2016-08-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93004
    title MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities
  • NASL family Databases
    NASL id MYSQL_5_7_14_RPM.NASL
    description The version of MySQL running on the remote host is 5.7.x prior to 5.7.14. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws exist in the InnoDB subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-3495, CVE-2016-5627, CVE-2016-5630) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5612) - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5628) - An unspecified flaw exists in the Memcached subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5631) - Multiple unspecified flaws exist in the Performance Schema subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5633, CVE-2016-8290) - An unspecified flaw exists in the RBR subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5634) - An unspecified flaw exists in the Security: Audit subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5635) - An unspecified flaw exists in the Replication subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-8284) - An unspecified flaw exists in the Replication subcomponent that allows a authenticated, remote attacker to cause a denial of service condition. (CVE-2016-8287) - An unspecified flaw exists in the InnoDB subcomponent that allows a local attacker to impact integrity and availability. (CVE-2016-8289) - A denial of service vulnerability exists in InnoDB when selecting full-text index information schema tables for a deleted table. An authenticated, remote attacker can exploit this to cause a segmentation fault. - A denial of service vulnerability exists in InnoDB when handling ALTER TABLE operations on tables that have an indexed virtual column. An authenticated, remote attacker can exploit this to cause an assertion failure, resulting in a server crash. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 93005
    published 2016-08-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93005
    title MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201701-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201701-01 (MariaDB and MySQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in MariaDB and MySQL. Please review the CVE identifiers referenced below for details. Impact : Attackers could execute arbitrary code, escalate privileges, and impact availability via unspecified vectors. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2017-01-03
    plugin id 96232
    published 2017-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96232
    title GLSA-201701-01 : MariaDB and MySQL: Multiple vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1283.NASL
    description mysql-community-server was updated to 5.6.34 to fix the following issues : - Changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 34.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 33.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 32.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 31.html - fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440, CVE-2016-5584, CVE-2016-5617, CVE-2016-5616, CVE-2016-5626, CVE-2016-3492, CVE-2016-5629, CVE-2016-5507, CVE-2016-8283, CVE-2016-5609, CVE-2016-5612, CVE-2016-5627, CVE-2016-5630, CVE-2016-8284, CVE-2016-8288, CVE-2016-3477, CVE-2016-2105, CVE-2016-3486, CVE-2016-3501, CVE-2016-3521, CVE-2016-3615, CVE-2016-3614, CVE-2016-3459, CVE-2016-5439, CVE-2016-5440 - fixes SUSE Bugs: [boo#999666], [boo#998309], [boo#1005581], [boo#1005558], [boo#1005563], [boo#1005562], [boo#1005566], [boo#1005555], [boo#1005569], [boo#1005557], [boo#1005582], [boo#1005560], [boo#1005561], [boo#1005567], [boo#1005570], [boo#1005583], [boo#1005586], [boo#989913], [boo#977614], [boo#989914], [boo#989915], [boo#989919], [boo#989922], [boo#989921], [boo#989911], [boo#989925], [boo#989926] - append '--ignore-db-dir=lost+found' to the mysqld options in 'mysql-systemd-helper' script if 'lost+found' directory is found in $datadir [boo#986251] - remove syslog.target from *.service files [boo#983938] - add systemd to deps to build on leap and friends - replace '%{_libexecdir}/systemd/system' with %{_unitdir} macro - remove useless mysql@default.service [boo#971456] - replace all occurrences of the string '@sysconfdir@' with '/etc' in mysql-community-server-5.6.3-logrotate.patch as it wasn't expanded properly [boo#990890] - remove '%define _rundir' as 13.1 is out of support scope - run 'usermod -g mysql mysql' only if mysql user is not in mysql group. Run 'usermod -s /bin/false/ mysql' only if mysql user doesn't have '/bin/false' shell set. - re-enable mysql profiling
    last seen 2019-02-21
    modified 2018-11-19
    plugin id 94694
    published 2016-11-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94694
    title openSUSE Security Update : mysql-community-server (openSUSE-2016-1283)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1289.NASL
    description mysql-community-server was updated to 5.6.34 to fix the following issues : - Changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 34.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 33.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 32.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6- 31.html - fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440, CVE-2016-5584, CVE-2016-5617, CVE-2016-5616, CVE-2016-5626, CVE-2016-3492, CVE-2016-5629, CVE-2016-5507, CVE-2016-8283, CVE-2016-5609, CVE-2016-5612, CVE-2016-5627, CVE-2016-5630, CVE-2016-8284, CVE-2016-8288, CVE-2016-3477, CVE-2016-2105, CVE-2016-3486, CVE-2016-3501, CVE-2016-3521, CVE-2016-3615, CVE-2016-3614, CVE-2016-3459, CVE-2016-5439, CVE-2016-5440 - fixes SUSE Bugs: [boo#999666], [boo#998309], [boo#1005581], [boo#1005558], [boo#1005563], [boo#1005562], [boo#1005566], [boo#1005555], [boo#1005569], [boo#1005557], [boo#1005582], [boo#1005560], [boo#1005561], [boo#1005567], [boo#1005570], [boo#1005583], [boo#1005586], [boo#989913], [boo#977614], [boo#989914], [boo#989915], [boo#989919], [boo#989922], [boo#989921], [boo#989911], [boo#989925], [boo#989926] - append '--ignore-db-dir=lost+found' to the mysqld options in 'mysql-systemd-helper' script if 'lost+found' directory is found in $datadir [boo#986251] - remove syslog.target from *.service files [boo#983938] - add systemd to deps to build on leap and friends - replace '%{_libexecdir}/systemd/system' with %{_unitdir} macro - remove useless mysql@default.service [boo#971456] - replace all occurrences of the string '@sysconfdir@' with '/etc' in mysql-community-server-5.6.3-logrotate.patch as it wasn't expanded properly [boo#990890] - remove '%define _rundir' as 13.1 is out of support scope - run 'usermod -g mysql mysql' only if mysql user is not in mysql group. Run 'usermod -s /bin/false/ mysql' only if mysql user doesn't have '/bin/false' shell set. - re-enable mysql profiling
    last seen 2019-02-21
    modified 2018-11-19
    plugin id 94756
    published 2016-11-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94756
    title openSUSE Security Update : mysql-community-server (openSUSE-2016-1289)
  • NASL family Databases
    NASL id MYSQL_5_6_32_RPM.NASL
    description The version of MySQL running on the remote host is 5.6.x prior to 5.6.32. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5612) - Multiple unspecified flaws exist in the InnoDB subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5627, CVE-2016-5630) - An unspecified flaw exists in the Replication subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-8284) - A denial of service vulnerability exists in the NAME_CONST() function when handling certain unspecified arguments. An authenticated, remote attacker can exploit this to cause the server to exit. - A denial of service vulnerability exists in InnoDB when selecting full-text index information schema tables for a deleted table. An authenticated, remote attacker can exploit this to cause a segmentation fault. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 93003
    published 2016-08-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93003
    title MySQL 5.6.x < 5.6.32 Multiple Vulnerabilities
  • NASL family Databases
    NASL id MYSQL_5_6_32.NASL
    description The version of MySQL running on the remote host is 5.6.x prior to 5.6.32. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5612) - Multiple unspecified flaws exist in the InnoDB subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. (CVE-2016-5627, CVE-2016-5630) - An unspecified flaw exists in the Replication subcomponent that allows a local attacker to cause a denial of service condition. (CVE-2016-8284) - A denial of service vulnerability exists in the NAME_CONST() function when handling certain unspecified arguments. An authenticated, remote attacker can exploit this to cause the server to exit. - A denial of service vulnerability exists in InnoDB when selecting full-text index information schema tables for a deleted table. An authenticated, remote attacker can exploit this to cause a segmentation fault. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 93002
    published 2016-08-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93002
    title MySQL 5.6.x < 5.6.32 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1274.NASL
    description This update for mariadb to 10.0.27 fixes the following issues : - release notes : - https://kb.askmonty.org/en/mariadb-10027-release-notes - https://kb.askmonty.org/en/mariadb-10026-release-notes - changelog : - https://kb.askmonty.org/en/mariadb-10027-changelog - https://kb.askmonty.org/en/mariadb-10026-changelog - fixed CVE's 10.0.27: CVE-2016-5612, CVE-2016-5630, CVE-2016-6662 10.0.26: CVE-2016-5440, CVE-2016-3615, CVE-2016-3521, CVE-2016-3477 - fix: [boo#1005561], [boo#1005570], [boo#998309], [boo#989926], [boo#989922], [boo#989919], [boo#989913] - requires devel packages for aio and lzo2 - remove mariadb-10.0.21-mysql-test_main_bootstrap.patch that is no longer needed [boo#984858] - append '--ignore-db-dir=lost+found' to the mysqld options in 'mysql-systemd-helper' script if 'lost+found' directory is found in $datadir [boo#986251] - remove syslog.target from *.service files [boo#983938] - add systemd to deps to build on leap and friends - replace '%{_libexecdir}/systemd/system' with %{_unitdir} macro - remove useless mysql@default.service [boo#971456] - make ORDER BY optimization functions take into account multiple equalities [boo#949520] - adjust mysql-test results in order to take account of a new option (orderby_uses_equalities) added by the optimizer patch [boo#1003800] - replace all occurrences of the string '@sysconfdir@' with '/etc' in mysql-community-server-5.1.46-logrotate.patch as it wasn't expanded properly [boo#990890]
    last seen 2019-02-21
    modified 2018-11-19
    plugin id 94649
    published 2016-11-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94649
    title openSUSE Security Update : mariadb (openSUSE-2016-1274)
redhat via4
advisories
  • rhsa
    id RHSA-2016:1601
  • rhsa
    id RHSA-2016:2927
refmap via4
bid 93674
confirm http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
gentoo GLSA-201701-01
sectrack 1037050
Last major update 11-01-2017 - 14:07
Published 25-10-2016 - 10:31
Last modified 04-03-2019 - 10:30
Back to Top