First Last Prev Next    This bug is not in your last search results.
Bug 1020873 - (CVE-2017-3312) VUL-0: CVE-2017-3312: mariadb,mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664
(CVE-2017-3312)
VUL-0: CVE-2017-3312: mariadb,mysql: insecure error log file handling in mysq...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/178816/
CVSSv2:SUSE:CVE-2017-3312:6.2:(AV:L/A...
:
Depends on:
Blocks: 1020868
  Show dependency tree / graph
 
Reported: 2017-01-19 12:02 UTC by Andreas Stieger
Modified: 2022-05-31 12:29 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2017-01-19 12:02:41 UTC 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server.

CVSS v3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1414133
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-3312
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-3312.html
Comment 1 Swamp Workflow Management 2017-01-19 23:01:01 UTC 
bugbot adjusting priority
Comment 5 Swamp Workflow Management 2017-02-06 23:07:57 UTC 
SUSE-SU-2017:0408-1: An update that solves 10 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1020868,1020873,1020875,1020877,1020882,1020884,1020885,1020890,1020891,1020894,1020896,1022428
CVE References: CVE-2017-3238,CVE-2017-3243,CVE-2017-3244,CVE-2017-3258,CVE-2017-3265,CVE-2017-3291,CVE-2017-3312,CVE-2017-3313,CVE-2017-3317,CVE-2017-3318
Sources used:
SUSE OpenStack Cloud 5 (src):    mysql-5.5.54-0.35.1
SUSE Manager Proxy 2.1 (src):    mysql-5.5.54-0.35.1
SUSE Manager 2.1 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Server 11-SP4 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    mysql-5.5.54-0.35.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    mysql-5.5.54-0.35.1
Comment 6 Swamp Workflow Management 2017-02-07 17:09:30 UTC 
SUSE-SU-2017:0411-1: An update that solves 11 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1008253,1020868,1020873,1020875,1020877,1020878,1020882,1020884,1020885,1020891,1020894,1020896,1022428
CVE References: CVE-2016-6664,CVE-2017-3238,CVE-2017-3243,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3291,CVE-2017-3312,CVE-2017-3317,CVE-2017-3318
Sources used:
SUSE Linux Enterprise Server for SAP 12 (src):    mariadb-10.0.29-20.23.1
SUSE Linux Enterprise Server 12-LTSS (src):    mariadb-10.0.29-20.23.1
Comment 7 Swamp Workflow Management 2017-02-07 17:12:04 UTC 
SUSE-SU-2017:0412-1: An update that solves 11 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1008253,1020868,1020873,1020875,1020877,1020878,1020882,1020884,1020885,1020891,1020894,1020896,1022428
CVE References: CVE-2016-6664,CVE-2017-3238,CVE-2017-3243,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3291,CVE-2017-3312,CVE-2017-3317,CVE-2017-3318
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Server 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Server 12-SP1 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    mariadb-10.0.29-22.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    mariadb-10.0.29-22.1
Comment 8 Kristyna Streitova 2017-02-09 12:45:29 UTC 
mysql
-----
|       Codestream       | Request  |
|------------------------|----------|
| SUSE:SLE-11-SP3:Update | #127359  |
| openSUSE:Leap:42.1     | #455749  |
| openSUSE:Leap:42.2     | via 42.1 |
| openSUSE:Factory       | #455744  |


mariadb
-------
|       Codestream       |        Request         |
|------------------------|------------------------|
| SUSE:SLE-12:Update     | #127527                |
| SUSE:SLE-12-SP1:Update | #127361                |
| openSUSE:Leap:42.1     | using sources from SLE |
| openSUSE:Leap:42.2     | using sources from SLE |
| openSUSE:Factory       | #455745                |


All done here. I'm reassigning it back to the security-team.
Comment 9 Bernhard Wiedemann 2017-02-09 13:01:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1020873) was mentioned in
https://build.opensuse.org/request/show/455749 42.1 / mysql-community-server
Comment 10 Swamp Workflow Management 2017-02-17 03:09:10 UTC 
openSUSE-SU-2017:0479-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1020872,1020873,1020875,1020876,1020877,1020878,1020882,1020884,1020885,1020890,1020893,1020894,1020896
CVE References: CVE-2016-8318,CVE-2016-8327,CVE-2017-3238,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3273,CVE-2017-3291,CVE-2017-3312,CVE-2017-3313,CVE-2017-3317,CVE-2017-3318
Sources used:
openSUSE Leap 42.1 (src):    mysql-community-server-5.6.35-22.1
Comment 11 Swamp Workflow Management 2017-02-17 03:17:05 UTC 
openSUSE-SU-2017:0486-1: An update that solves 11 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1008253,1020868,1020873,1020875,1020877,1020878,1020882,1020884,1020885,1020891,1020894,1020896,1022428
CVE References: CVE-2016-6664,CVE-2017-3238,CVE-2017-3243,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3291,CVE-2017-3312,CVE-2017-3317,CVE-2017-3318
Sources used:
openSUSE Leap 42.2 (src):    mariadb-10.0.29-18.1
openSUSE Leap 42.1 (src):    mariadb-10.0.29-18.1
Comment 12 Bernhard Wiedemann 2017-03-03 19:03:07 UTC 
This is an autogenerated message for OBS integration:
This bug (1020873) was mentioned in
https://build.opensuse.org/request/show/476795 42.2 / mysql-community-server
Comment 13 Swamp Workflow Management 2017-03-07 02:08:57 UTC 
openSUSE-SU-2017:0618-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1020872,1020873,1020875,1020876,1020877,1020878,1020882,1020884,1020885,1020890,1020893,1020894,1020896
CVE References: CVE-2016-8318,CVE-2016-8327,CVE-2017-3238,CVE-2017-3244,CVE-2017-3257,CVE-2017-3258,CVE-2017-3265,CVE-2017-3273,CVE-2017-3291,CVE-2017-3312,CVE-2017-3313,CVE-2017-3317,CVE-2017-3318
Sources used:
openSUSE Leap 42.2 (src):    mysql-community-server-5.6.35-22.1
Comment 14 Marcus Meissner 2017-04-24 13:27:22 UTC 
released
First Last Prev Next    This bug is not in your last search results.