Bug 1020875 - (CVE-2017-3258) VUL-0: CVE-2017-3258: mariadb,mysql: unspecified vulnerability in the DDL component (CPU Jan 2017)
(CVE-2017-3258)
VUL-0: CVE-2017-3258: mariadb,mysql: unspecified vulnerability in the DDL co...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/178827/
CVSSv2:SUSE:CVE-2017-3258:6.8:(AV:N/A...
:
Depends on:
Blocks: 1020868
  Show dependency treegraph
 
Reported: 2017-01-19 12:06 UTC by Andreas Stieger
Modified: 2022-05-31 12:30 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2017-01-19 12:06:02 UTC
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL ). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

CVSS v3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1414351
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-3258
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-3258.html
Comment 1 Swamp Workflow Management 2017-01-19 23:01:13 UTC
bugbot adjusting priority
Comment 5 Swamp Workflow Management 2017-02-03 07:58:30 UTC
An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2017-02-10.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63379
Comment 6 Swamp Workflow Management 2017-02-06 23:08:07 UTC
SUSE-SU-2017:0408-1: An update that solves 10 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1020868,1020873,1020875,1020877,1020882,1020884,1020885,1020890,1020891,1020894,1020896,1022428
CVE References: CVE-2017-3238,CVE-2017-3243,CVE-2017-3244,CVE-2017-3258,CVE-2017-3265,CVE-2017-3291,CVE-2017-3312,CVE-2017-3313,CVE-2017-3317,CVE-2017-3318
Sources used:
SUSE OpenStack Cloud 5 (src):    mysql-5.5.54-0.35.1
SUSE Manager Proxy 2.1 (src):    mysql-5.5.54-0.35.1
SUSE Manager 2.1 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Server 11-SP4 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    mysql-5.5.54-0.35.1
Comment 7 Swamp Workflow Management 2017-02-07 17:09:41 UTC
SUSE-SU-2017:0411-1: An update that solves 11 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1008253,1020868,1020873,1020875,1020877,1020878,1020882,1020884,1020885,1020891,1020894,1020896,1022428
CVE References: CVE-2016-6664,CVE-2017-3238,CVE-2017-3243,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3291,CVE-2017-3312,CVE-2017-3317,CVE-2017-3318
Sources used:
SUSE Linux Enterprise Server for SAP 12 (src):    mariadb-10.0.29-20.23.1
SUSE Linux Enterprise Server 12-LTSS (src):    mariadb-10.0.29-20.23.1
Comment 8 Swamp Workflow Management 2017-02-07 17:12:14 UTC
SUSE-SU-2017:0412-1: An update that solves 11 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1008253,1020868,1020873,1020875,1020877,1020878,1020882,1020884,1020885,1020891,1020894,1020896,1022428
CVE References: CVE-2016-6664,CVE-2017-3238,CVE-2017-3243,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3291,CVE-2017-3312,CVE-2017-3317,CVE-2017-3318
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Server 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Server 12-SP1 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    mariadb-10.0.29-22.1
Comment 9 Kristyna Streitova 2017-02-09 12:44:42 UTC
mysql
-----
|       Codestream       | Request  |
|------------------------|----------|
| SUSE:SLE-11-SP3:Update | #127359  |
| openSUSE:Leap:42.1     | #455749  |
| openSUSE:Leap:42.2     | via 42.1 |
| openSUSE:Factory       | #455744  |


mariadb
-------
|       Codestream       |        Request         |
|------------------------|------------------------|
| SUSE:SLE-12:Update     | #127527                |
| SUSE:SLE-12-SP1:Update | #127361                |
| openSUSE:Leap:42.1     | using sources from SLE |
| openSUSE:Leap:42.2     | using sources from SLE |
| openSUSE:Factory       | #455745                |


All done here. I'm reassigning it back to the security-team.
Comment 10 Bernhard Wiedemann 2017-02-09 13:01:09 UTC
This is an autogenerated message for OBS integration:
This bug (1020875) was mentioned in
https://build.opensuse.org/request/show/455749 42.1 / mysql-community-server
Comment 11 Swamp Workflow Management 2017-02-17 03:09:26 UTC
openSUSE-SU-2017:0479-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1020872,1020873,1020875,1020876,1020877,1020878,1020882,1020884,1020885,1020890,1020893,1020894,1020896
CVE References: CVE-2016-8318,CVE-2016-8327,CVE-2017-3238,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3273,CVE-2017-3291,CVE-2017-3312,CVE-2017-3313,CVE-2017-3317,CVE-2017-3318
Sources used:
openSUSE Leap 42.1 (src):    mysql-community-server-5.6.35-22.1
Comment 12 Swamp Workflow Management 2017-02-17 03:17:16 UTC
openSUSE-SU-2017:0486-1: An update that solves 11 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1008253,1020868,1020873,1020875,1020877,1020878,1020882,1020884,1020885,1020891,1020894,1020896,1022428
CVE References: CVE-2016-6664,CVE-2017-3238,CVE-2017-3243,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3291,CVE-2017-3312,CVE-2017-3317,CVE-2017-3318
Sources used:
openSUSE Leap 42.2 (src):    mariadb-10.0.29-18.1
openSUSE Leap 42.1 (src):    mariadb-10.0.29-18.1
Comment 13 Bernhard Wiedemann 2017-03-03 19:03:17 UTC
This is an autogenerated message for OBS integration:
This bug (1020875) was mentioned in
https://build.opensuse.org/request/show/476795 42.2 / mysql-community-server
Comment 14 Swamp Workflow Management 2017-03-07 02:09:05 UTC
openSUSE-SU-2017:0618-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1020872,1020873,1020875,1020876,1020877,1020878,1020882,1020884,1020885,1020890,1020893,1020894,1020896
CVE References: CVE-2016-8318,CVE-2016-8327,CVE-2017-3238,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3273,CVE-2017-3291,CVE-2017-3312,CVE-2017-3313,CVE-2017-3317,CVE-2017-3318
Sources used:
openSUSE Leap 42.2 (src):    mysql-community-server-5.6.35-22.1
Comment 15 Marcus Meissner 2017-04-24 13:27:41 UTC
released