Bug 1020890 - (CVE-2017-3313) VUL-0: CVE-2017-3313: mariadb,mysql: unspecified vulnerability affecting the MyISAM component (CPU Jan 2017)
(CVE-2017-3313)
VUL-0: CVE-2017-3313: mariadb,mysql: unspecified vulnerability affecting the ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Minor
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/178829/
CVSSv2:SUSE:CVE-2017-3313:3.8:(AV:L/A...
:
Depends on:
Blocks: 1020868
  Show dependency treegraph
 
Reported: 2017-01-19 12:35 UTC by Andreas Stieger
Modified: 2019-08-16 15:22 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2017-01-19 12:35:14 UTC
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM ). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data.

CVSS v3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). 


References:
https://bugzilla.redhat.com/show_bug.cgi?id=1414353
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-3313
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-3313.html
Comment 1 Swamp Workflow Management 2017-01-19 23:03:01 UTC
bugbot adjusting priority
Comment 3 Swamp Workflow Management 2017-02-06 23:08:55 UTC
SUSE-SU-2017:0408-1: An update that solves 10 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1020868,1020873,1020875,1020877,1020882,1020884,1020885,1020890,1020891,1020894,1020896,1022428
CVE References: CVE-2017-3238,CVE-2017-3243,CVE-2017-3244,CVE-2017-3258,CVE-2017-3265,CVE-2017-3291,CVE-2017-3312,CVE-2017-3313,CVE-2017-3317,CVE-2017-3318
Sources used:
SUSE OpenStack Cloud 5 (src):    mysql-5.5.54-0.35.1
SUSE Manager Proxy 2.1 (src):    mysql-5.5.54-0.35.1
SUSE Manager 2.1 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Server 11-SP4 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    mysql-5.5.54-0.35.1
Comment 4 Kristyna Streitova 2017-02-09 13:01:50 UTC
mysql
-----
|       Codestream       | Request  |
|------------------------|----------|
| SUSE:SLE-11-SP3:Update | #127359  |
| openSUSE:Leap:42.1     | #455749  |
| openSUSE:Leap:42.2     | via 42.1 |
| openSUSE:Factory       | #455744  |


mariadb
-------
It's not fixed yet in the MariaDB upstream.


I'm reassigning it back to the security-team. Feel free to reassign it back when the mariadb submission is needed. Thanks!
Comment 5 Bernhard Wiedemann 2017-02-09 13:01:51 UTC
This is an autogenerated message for OBS integration:
This bug (1020890) was mentioned in
https://build.opensuse.org/request/show/455749 42.1 / mysql-community-server
Comment 6 Swamp Workflow Management 2017-02-17 03:11:14 UTC
openSUSE-SU-2017:0479-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1020872,1020873,1020875,1020876,1020877,1020878,1020882,1020884,1020885,1020890,1020893,1020894,1020896
CVE References: CVE-2016-8318,CVE-2016-8327,CVE-2017-3238,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3273,CVE-2017-3291,CVE-2017-3312,CVE-2017-3313,CVE-2017-3317,CVE-2017-3318
Sources used:
openSUSE Leap 42.1 (src):    mysql-community-server-5.6.35-22.1
Comment 7 Bernhard Wiedemann 2017-03-03 19:04:24 UTC
This is an autogenerated message for OBS integration:
This bug (1020890) was mentioned in
https://build.opensuse.org/request/show/476795 42.2 / mysql-community-server
Comment 8 Swamp Workflow Management 2017-03-07 02:10:12 UTC
openSUSE-SU-2017:0618-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1020872,1020873,1020875,1020876,1020877,1020878,1020882,1020884,1020885,1020890,1020893,1020894,1020896
CVE References: CVE-2016-8318,CVE-2016-8327,CVE-2017-3238,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3273,CVE-2017-3291,CVE-2017-3312,CVE-2017-3313,CVE-2017-3317,CVE-2017-3318
Sources used:
openSUSE Leap 42.2 (src):    mysql-community-server-5.6.35-22.1
Comment 9 Kristyna Streitova 2017-03-15 14:10:11 UTC
mariadb
-------
- CVE-2017-3313 was fixed [1] in the latest MariaDB 10.0.30 and MariaDB 10.1.22


[1] https://mariadb.com/kb/en/mariadb/security/
Comment 11 Swamp Workflow Management 2017-05-16 19:09:34 UTC
SUSE-SU-2017:1311-1: An update that solves two vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1020890,1020976,1022428,1034911
CVE References: CVE-2017-3302,CVE-2017-3313
Sources used:
SUSE Linux Enterprise Server for SAP 12 (src):    mariadb-10.0.30-20.26.1
SUSE Linux Enterprise Server 12-LTSS (src):    mariadb-10.0.30-20.26.1
Comment 12 Swamp Workflow Management 2017-05-16 19:14:23 UTC
SUSE-SU-2017:1315-1: An update that solves two vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1020868,1020890,1020976,1022428,1034911,996821
CVE References: CVE-2017-3302,CVE-2017-3313
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    mariadb-10.0.30-25.1
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    mariadb-10.0.30-25.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    mariadb-10.0.30-25.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    mariadb-10.0.30-25.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    mariadb-10.0.30-25.1
SUSE Linux Enterprise Server 12-SP2 (src):    mariadb-10.0.30-25.1
SUSE Linux Enterprise Server 12-SP1 (src):    mariadb-10.0.30-25.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    mariadb-10.0.30-25.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    mariadb-10.0.30-25.1
Comment 13 Swamp Workflow Management 2017-06-02 10:09:38 UTC
openSUSE-SU-2017:1475-1: An update that solves two vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1020868,1020890,1020976,1022428,1034911,1038740,996821
CVE References: CVE-2017-3302,CVE-2017-3313
Sources used:
openSUSE Leap 42.2 (src):    mariadb-10.0.30-20.4.1
Comment 14 Marcus Meissner 2017-10-26 05:50:52 UTC
released