Vulnerability-Lookup

CVE-2017-3302 (GCVE-0-2017-3302)

Vulnerability from cvelistv5 – Published: 2017-02-12 04:43 – Updated: 2024-10-08 20:13

Summary

Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 20:04 UTC

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Assigner

oracle mitre root

References

10 references

URL	Tags
http://www.securityfocus.com/bid/96162	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2017:2787	vendor-advisoryx_refsource_REDHAT
http://www.securitytracker.com/id/1038287	vdb-entryx_refsource_SECTRACK
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:0574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:0279	vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2017/dsa-3834	vendor-advisoryx_refsource_DEBIAN
http://www.debian.org/security/2017/dsa-3809	vendor-advisoryx_refsource_DEBIAN
http://www.openwall.com/lists/oss-security/2017/0…	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2017:2192	vendor-advisoryx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version	CPE status
Oracle Corporation	MySQL Server	Affected: 5.5.54 and earlier Affected: 5.6.20 and earlier	guessed

Date Public

2017-02-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:23:33.637Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96162",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96162"
          },
          {
            "name": "RHSA-2017:2787",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2787"
          },
          {
            "name": "1038287",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038287"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
          },
          {
            "name": "RHSA-2018:0574",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0574"
          },
          {
            "name": "RHSA-2018:0279",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0279"
          },
          {
            "name": "DSA-3834",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3834"
          },
          {
            "name": "DSA-3809",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3809"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/02/11/11"
          },
          {
            "name": "RHSA-2017:2192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2192"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2017-3302",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T20:04:48.579501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-08T20:13:36.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MySQL Server",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "5.5.54 and earlier"
            },
            {
              "status": "affected",
              "version": "5.6.20 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2017-02-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-22T09:57:01.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "96162",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96162"
        },
        {
          "name": "RHSA-2017:2787",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2787"
        },
        {
          "name": "1038287",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038287"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
        },
        {
          "name": "RHSA-2018:0574",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0574"
        },
        {
          "name": "RHSA-2018:0279",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0279"
        },
        {
          "name": "DSA-3834",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3834"
        },
        {
          "name": "DSA-3809",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3809"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/02/11/11"
        },
        {
          "name": "RHSA-2017:2192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2192"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2017-3302",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MySQL Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.5.54 and earlier"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "5.6.20 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96162",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96162"
            },
            {
              "name": "RHSA-2017:2787",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2787"
            },
            {
              "name": "1038287",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038287"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
            },
            {
              "name": "RHSA-2018:0574",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0574"
            },
            {
              "name": "RHSA-2018:0279",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0279"
            },
            {
              "name": "DSA-3834",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3834"
            },
            {
              "name": "DSA-3809",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3809"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2017/02/11/11",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2017/02/11/11"
            },
            {
              "name": "RHSA-2017:2192",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2192"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2017-3302",
    "datePublished": "2017-02-12T04:43:00.000Z",
    "dateReserved": "2016-12-06T00:00:00.000Z",
    "dateUpdated": "2024-10-08T20:13:36.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-3302",
      "date": "2026-09-15",
      "epss": "0.04905",
      "percentile": "0.91616"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.6.0\", \"versionEndExcluding\": \"5.6.21\", \"matchCriteriaId\": \"B0C4A1F9-3C06-443E-A34D-743396F8E3C4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.7.0\", \"versionEndExcluding\": \"5.7.5\", \"matchCriteriaId\": \"DF260A4F-5B6A-415B-8857-1EF4B02267EE\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"5.5.54\", \"matchCriteriaId\": \"402A7D46-9168-44F4-9D73-053A68BE6C5E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"10.0.0\", \"versionEndIncluding\": \"10.0.29\", \"matchCriteriaId\": \"6C08F580-8B61-4AE7-BE14-61B3049DF8EF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"10.1.0\", \"versionEndIncluding\": \"10.1.21\", \"matchCriteriaId\": \"A5033B0F-346B-45CE-943D-B2FA398FB1A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"10.2.0\", \"versionEndIncluding\": \"10.2.3\", \"matchCriteriaId\": \"FD4D6819-4993-40C7-BC41-B8B830385EC2\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"33C068A4-3780-4EAB-A937-6082DF847564\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51EF4996-72F4-4FA4-814F-F5991E7A8318\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D99A687E-EAE6-417E-A88E-D0082BC194CD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B353CE99-D57C-465B-AAB0-73EF581127D1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BF77CDCF-B9C9-427D-B2BF-36650FB2148C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"825ECE2D-E232-46E0-A047-074B34DB1E97\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.\"}, {\"lang\": \"es\", \"value\": \"Ca\\u00edda en libmysqlclient.so en Oracle MySQL en versiones anteriores 5.6.21 y 5.7.x en versiones anteriores 5.7.5 y MariaDB hasta la versi\\u00f3n 5.5.54, 10.0.x hasta la versi\\u00f3n 10.0.29, 10.1.x hasta la versi\\u00f3n 10.1.21 y 10.2.x hasta la versi\\u00f3n 10.2.3.\"}]",
      "id": "CVE-2017-3302",
      "lastModified": "2024-11-21T03:25:14.293",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2017-02-12T04:59:00.127",
      "references": "[{\"url\": \"http://www.debian.org/security/2017/dsa-3809\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.debian.org/security/2017/dsa-3834\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2017/02/11/11\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/96162\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id/1038287\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2192\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2787\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0279\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0574\", \"source\": \"secalert_us@oracle.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.debian.org/security/2017/dsa-3809\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.debian.org/security/2017/dsa-3834\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2017/02/11/11\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/96162\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id/1038287\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2192\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2787\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0279\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0574\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "secalert_us@oracle.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-3302\",\"sourceIdentifier\":\"secalert_us@oracle.com\",\"published\":\"2017-02-12T04:59:00.127\",\"lastModified\":\"2026-05-13T00:24:29.033\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.\"},{\"lang\":\"es\",\"value\":\"Ca\u00edda en libmysqlclient.so en Oracle MySQL en versiones anteriores 5.6.21 y 5.7.x en versiones anteriores 5.7.5 y MariaDB hasta la versi\u00f3n 5.5.54, 10.0.x hasta la versi\u00f3n 10.0.29, 10.1.x hasta la versi\u00f3n 10.1.21 y 10.2.x hasta la versi\u00f3n 10.2.3.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6.0\",\"versionEndExcluding\":\"5.6.21\",\"matchCriteriaId\":\"B0C4A1F9-3C06-443E-A34D-743396F8E3C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.7.0\",\"versionEndExcluding\":\"5.7.5\",\"matchCriteriaId\":\"DF260A4F-5B6A-415B-8857-1EF4B02267EE\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"5.5.54\",\"matchCriteriaId\":\"402A7D46-9168-44F4-9D73-053A68BE6C5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndIncluding\":\"10.0.29\",\"matchCriteriaId\":\"6C08F580-8B61-4AE7-BE14-61B3049DF8EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.1.0\",\"versionEndIncluding\":\"10.1.21\",\"matchCriteriaId\":\"A5033B0F-346B-45CE-943D-B2FA398FB1A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.2.0\",\"versionEndIncluding\":\"10.2.3\",\"matchCriteriaId\":\"FD4D6819-4993-40C7-BC41-B8B830385EC2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33C068A4-3780-4EAB-A937-6082DF847564\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51EF4996-72F4-4FA4-814F-F5991E7A8318\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D99A687E-EAE6-417E-A88E-D0082BC194CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B353CE99-D57C-465B-AAB0-73EF581127D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EC0D196-F7B8-4BDD-9050-779F7A7FBEE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF77CDCF-B9C9-427D-B2BF-36650FB2148C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"825ECE2D-E232-46E0-A047-074B34DB1E97\"}]}]}],\"references\":[{\"url\":\"http://www.debian.org/security/2017/dsa-3809\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2017/dsa-3834\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2017/02/11/11\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/96162\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1038287\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2192\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2787\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:0279\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:0574\",\"source\":\"secalert_us@oracle.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2017/dsa-3809\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2017/dsa-3834\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2017/02/11/11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/96162\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1038287\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2192\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2787\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:0279\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:0574\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T11:16:01+00:00",
      "cve": "CVE-2017-3302",
      "id": "CVE-2017-3302",
      "initial_release_date": "2017-01-27T00:00:00+00:00",
      "product_status:fixed": "362",
      "product_status:known_affected": "10",
      "product_status:known_not_affected": "25",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "mysql: prepared statement handle use-after-free after disconnect",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-3302.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T23:53:54Z",
      "cve": "CVE-2017-3302",
      "id": "CVE-2017-3302",
      "initial_release_date": "2023-02-15T04:52:02Z",
      "product_status:known_affected": "35",
      "product_status:known_not_affected": "116",
      "product_status:recommended": "658",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2017-3302",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2017-3302.json",
      "version": "23"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.securityfocus.com/bid/96162\", \"name\": \"96162\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2787\", \"name\": \"RHSA-2017:2787\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"http://www.securitytracker.com/id/1038287\", \"name\": \"1038287\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\", \"x_transferred\"]}, {\"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0574\", \"name\": \"RHSA-2018:0574\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0279\", \"name\": \"RHSA-2018:0279\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"http://www.debian.org/security/2017/dsa-3834\", \"name\": \"DSA-3834\", \"tags\": [\"vendor-advisory\", \"x_refsource_DEBIAN\", \"x_transferred\"]}, {\"url\": \"http://www.debian.org/security/2017/dsa-3809\", \"name\": \"DSA-3809\", \"tags\": [\"vendor-advisory\", \"x_refsource_DEBIAN\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2017/02/11/11\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2192\", \"name\": \"RHSA-2017:2192\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-05T14:23:33.637Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2017-3302\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-08T20:04:48.579501Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-08T20:05:15.578Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Oracle Corporation\", \"product\": \"MySQL Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.5.54 and earlier\"}, {\"status\": \"affected\", \"version\": \"5.6.20 and earlier\"}]}], \"datePublic\": \"2017-02-11T00:00:00.000Z\", \"references\": [{\"url\": \"http://www.securityfocus.com/bid/96162\", \"name\": \"96162\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2787\", \"name\": \"RHSA-2017:2787\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"http://www.securitytracker.com/id/1038287\", \"name\": \"1038287\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\"]}, {\"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0574\", \"name\": \"RHSA-2018:0574\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0279\", \"name\": \"RHSA-2018:0279\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"http://www.debian.org/security/2017/dsa-3834\", \"name\": \"DSA-3834\", \"tags\": [\"vendor-advisory\", \"x_refsource_DEBIAN\"]}, {\"url\": \"http://www.debian.org/security/2017/dsa-3809\", \"name\": \"DSA-3809\", \"tags\": [\"vendor-advisory\", \"x_refsource_DEBIAN\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2017/02/11/11\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2192\", \"name\": \"RHSA-2017:2192\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.\"}]}], \"providerMetadata\": {\"orgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"shortName\": \"oracle\", \"dateUpdated\": \"2018-03-22T09:57:01.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"5.5.54 and earlier\", \"version_affected\": \"=\"}, {\"version_value\": \"5.6.20 and earlier\", \"version_affected\": \"=\"}]}, \"product_name\": \"MySQL Server\"}]}, \"vendor_name\": \"Oracle Corporation\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"http://www.securityfocus.com/bid/96162\", \"name\": \"96162\", \"refsource\": \"BID\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2787\", \"name\": \"RHSA-2017:2787\", \"refsource\": \"REDHAT\"}, {\"url\": \"http://www.securitytracker.com/id/1038287\", \"name\": \"1038287\", \"refsource\": \"SECTRACK\"}, {\"url\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html\", \"name\": \"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0574\", \"name\": \"RHSA-2018:0574\", \"refsource\": \"REDHAT\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:0279\", \"name\": \"RHSA-2018:0279\", \"refsource\": \"REDHAT\"}, {\"url\": \"http://www.debian.org/security/2017/dsa-3834\", \"name\": \"DSA-3834\", \"refsource\": \"DEBIAN\"}, {\"url\": \"http://www.debian.org/security/2017/dsa-3809\", \"name\": \"DSA-3809\", \"refsource\": \"DEBIAN\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2017/02/11/11\", \"name\": \"http://www.openwall.com/lists/oss-security/2017/02/11/11\", \"refsource\": \"MISC\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2192\", \"name\": \"RHSA-2017:2192\", \"refsource\": \"REDHAT\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2017-3302\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"secalert_us@oracle.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2017-3302\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-08T20:13:36.675Z\", \"dateReserved\": \"2016-12-06T00:00:00.000Z\", \"assignerOrgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"datePublished\": \"2017-02-12T04:43:00.000Z\", \"assignerShortName\": \"oracle\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

SUSE-SU-2018:1853-1

Vulnerability from csaf_suse - Published: 2018-06-29 15:40 - Updated: 2018-06-29 15:40

Summary

Recommended update for mariadb

Severity

Important

Scope

41 vulnerabilities in this advisory, including CVE-2017-3302.

CVE-2017-3302

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 9 products

Open the full advisory

ubuntu-cve-2017-3302

Vulnerability from osv_ubuntu

Published

2017-02-11 00:00

Modified

2026-04-22 07:38

Summary

Details

Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

Severity

7.5 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-3302	REPORT
	http://www.openwall.com/lists/oss-security/2017/01/28/1	REPORT
	http://www.openwall.com/lists/oss-security/2017/0…	REPORT
	http://www.oracle.com/technetwork/security-adviso…	REPORT
	https://ubuntu.com/security/notices/USN-3269-1	ADVISORY
	https://ubuntu.com/security/notices/USN-3357-2	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-3302	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libmariadbclient18",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          },
          {
            "binary_name": "mariadb-client",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          },
          {
            "binary_name": "mariadb-client-5.5",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          },
          {
            "binary_name": "mariadb-client-core-5.5",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          },
          {
            "binary_name": "mariadb-common",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          },
          {
            "binary_name": "mariadb-server",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          },
          {
            "binary_name": "mariadb-server-5.5",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          },
          {
            "binary_name": "mariadb-server-core-5.5",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          },
          {
            "binary_name": "mariadb-test",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          },
          {
            "binary_name": "mariadb-test-5.5",
            "binary_version": "5.5.56-1ubuntu0.14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "mariadb-5.5",
        "purl": "pkg:deb/ubuntu/mariadb-5.5@5.5.56-1ubuntu0.14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.56-1ubuntu0.14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.5.32-1ubuntu1",
        "5.5.35-1ubuntu1",
        "5.5.36-1",
        "5.5.37-0ubuntu0.14.04.1",
        "5.5.39-0ubuntu0.14.04.1",
        "5.5.40-0ubuntu0.14.04.1",
        "5.5.41-0ubuntu0.14.04.2",
        "5.5.41-1ubuntu0.14.04.1",
        "5.5.43-1ubuntu0.14.04.2",
        "5.5.44-1ubuntu0.14.04.1",
        "5.5.46-1ubuntu0.14.04.2",
        "5.5.47-1ubuntu0.14.04.1",
        "5.5.49-1ubuntu0.14.04.1",
        "5.5.52-1ubuntu0.14.04.1",
        "5.5.53-1ubuntu0.14.04.1",
        "5.5.54-1ubuntu0.14.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libmysqlclient18",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "libmysqld-pic",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-client",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-client-5.5",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-client-core-5.5",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-common",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-server",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-server-5.5",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-server-core-5.5",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-source-5.5",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-testsuite",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "mysql-testsuite-5.5",
            "binary_version": "5.5.55-0ubuntu0.14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "mysql-5.5",
        "purl": "pkg:deb/ubuntu/mysql-5.5@5.5.55-0ubuntu0.14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.55-0ubuntu0.14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.5.32-0ubuntu7",
        "5.5.34-0ubuntu1",
        "5.5.34-0ubuntu2",
        "5.5.35-0ubuntu1",
        "5.5.35+dfsg-1ubuntu1",
        "5.5.37-0ubuntu0.14.04.1",
        "5.5.38-0ubuntu0.14.04.1",
        "5.5.40-0ubuntu0.14.04.1",
        "5.5.41-0ubuntu0.14.04.1",
        "5.5.43-0ubuntu0.14.04.1",
        "5.5.44-0ubuntu0.14.04.1",
        "5.5.46-0ubuntu0.14.04.2",
        "5.5.47-0ubuntu0.14.04.1",
        "5.5.49-0ubuntu0.14.04.1",
        "5.5.50-0ubuntu0.14.04.1",
        "5.5.52-0ubuntu0.14.04.1",
        "5.5.53-0ubuntu0.14.04.1",
        "5.5.54-0ubuntu0.14.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "percona-server-server",
            "binary_version": "5.6.22-rel71.0-0ubuntu4.1"
          },
          {
            "binary_name": "percona-server-server-5.6",
            "binary_version": "5.6.22-rel71.0-0ubuntu4.1"
          },
          {
            "binary_name": "percona-server-source-5.6",
            "binary_version": "5.6.22-rel71.0-0ubuntu4.1"
          },
          {
            "binary_name": "percona-server-test",
            "binary_version": "5.6.22-rel71.0-0ubuntu4.1"
          },
          {
            "binary_name": "percona-server-test-5.6",
            "binary_version": "5.6.22-rel71.0-0ubuntu4.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "percona-server-5.6",
        "purl": "pkg:deb/ubuntu/percona-server-5.6@5.6.22-rel71.0-0ubuntu4.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.6.22-rel71.0-0ubuntu2",
        "5.6.22-rel71.0-0ubuntu4",
        "5.6.22-rel71.0-0ubuntu4.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "percona-xtradb-cluster-server",
            "binary_version": "5.6.37-26.21-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "percona-xtradb-cluster-server-5.6",
            "binary_version": "5.6.37-26.21-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "percona-xtradb-cluster-source-5.6",
            "binary_version": "5.6.37-26.21-0ubuntu0.16.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "percona-xtradb-cluster-5.6",
        "purl": "pkg:deb/ubuntu/percona-xtradb-cluster-5.6@5.6.37-26.21-0ubuntu0.16.04.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.6.21-25.8-0ubuntu2",
        "5.6.21-25.8-0ubuntu3",
        "5.6.21-25.8-0ubuntu3.1",
        "5.6.21-25.8-0ubuntu3.2",
        "5.6.34-26.19-0ubuntu0.16.04.1",
        "5.6.34-26.19-0ubuntu0.16.04.2",
        "5.6.37-26.21-0ubuntu0.16.04.1",
        "5.6.37-26.21-0ubuntu0.16.04.2"
      ]
    }
  ],
  "aliases": [],
  "details": "Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.",
  "id": "UBUNTU-CVE-2017-3302",
  "modified": "2026-04-22T07:38:09Z",
  "published": "2017-02-11T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-3302"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2017/01/28/1"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2017/02/11/11"
    },
    {
      "type": "REPORT",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3269-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3357-2"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-3302"
    }
  ],
  "related": [
    "USN-3269-1",
    "USN-3357-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-3302"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2017-3302 (GCVE-0-2017-3302)

SUSE-SU-2018:1853-1

ubuntu-cve-2017-3302

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature