CVE-2017-3291

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).

Root Privilege Escalation (CVE-2016-6664).

Unspecified vulnerability affecting the Optimizer component (CVE-2017-3238).

Unspecified vulnerability affecting the Charsets component (CVE-2017-3243).

Unspecified vulnerability affecing the DML component (CVE-2017-3244).

Unspecified vulnerability affecting InnoDB (CVE-2017-3257).

Unspecified vulnerability in the DDL component (CVE-2017-3258).

Unsafe chmod/chown use in init script (CVE-2017-3265).

Unrestricted mysqld_safe's ledir (CVE-2017-3291).

Insecure error log file handling in mysqld_safe, due to an incomplete fix for CVE-2016-6664 (CVE-2017-3312).

Unspecified vulnerability affecting Logging (CVE-2017-3317).

Unspecified vulnerability affecting Error Handling (CVE-2017-3318).

Applications using the client library for MySQL (libmysqlclient.so) had a use-after-free issue that could cause the applications to crash (bsc#1022428).

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This mysql version update to 5.5.54 fixes the following issues:

• CVE-2017-3318: Unspecified vulnerability affecting Error Handling (bsc#1020896)
• CVE-2017-3317: Unspecified vulnerability affecting Logging (bsc#1020894)
• CVE-2017-3313: Unspecified vulnerability affecting the MyISAM component (bsc#1020890)
• CVE-2017-3312: Insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 (bsc#1020873)
• CVE-2017-3291: Unrestricted mysqld_safe's ledir (bsc#1020884)
• CVE-2017-3265: Unsafe chmod/chown use in init script (bsc#1020885)
• CVE-2017-3258: Unspecified vulnerability in the DDL component (bsc#1020875)
• CVE-2017-3244: Unspecified vulnerability affecing the DML component (bsc#1020877)
• CVE-2017-3243: Unspecified vulnerability affecting the Charsets component (bsc#1020891)
• CVE-2017-3238: Unspecified vulnerability affecting the Optimizer component (bsc#1020882)
• Applications using the client library for MySQL (libmysqlclient.so) had a use-after-free issue that could cause the applications to crash (bsc#1022428)

Release Notes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html

This mariadb version update to 10.0.29 fixes the following issues:

• CVE-2017-3318: unspecified vulnerability affecting Error Handling (bsc#1020896)

• CVE-2017-3317: unspecified vulnerability affecting Logging (bsc#1020894)

• CVE-2017-3312: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 (bsc#1020873)

• CVE-2017-3291: unrestricted mysqld_safe's ledir (bsc#1020884)

• CVE-2017-3265: unsafe chmod/chown use in init script (bsc#1020885)

• CVE-2017-3258: unspecified vulnerability in the DDL component (bsc#1020875)

• CVE-2017-3257: unspecified vulnerability affecting InnoDB (bsc#1020878)

• CVE-2017-3244: unspecified vulnerability affecing the DML component (bsc#1020877)

• CVE-2017-3243: unspecified vulnerability affecting the Charsets component (bsc#1020891)

• CVE-2017-3238: unspecified vulnerability affecting the Optimizer component (bsc#1020882)

• CVE-2016-6664: Root Privilege Escalation (bsc#1008253)

• Applications using the client library for MySQL (libmysqlclient.so) had a use-after-free issue that could cause the applications to crash (bsc#1022428)

• notable changes:

  • XtraDB updated to 5.6.34-79.1
  • TokuDB updated to 5.6.34-79.1
  • Innodb updated to 5.6.35
  • Performance Schema updated to 5.6.35

Release notes and changelog:

• https://kb.askmonty.org/en/mariadb-10029-release-notes
• https://kb.askmonty.org/en/mariadb-10029-changelog

This mariadb version update to 10.0.29 fixes the following issues:

• CVE-2017-3318: unspecified vulnerability affecting Error Handling (bsc#1020896)

• CVE-2017-3317: unspecified vulnerability affecting Logging (bsc#1020894)

• CVE-2017-3312: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 (bsc#1020873)

• CVE-2017-3291: unrestricted mysqld_safe's ledir (bsc#1020884)

• CVE-2017-3265: unsafe chmod/chown use in init script (bsc#1020885)

• CVE-2017-3258: unspecified vulnerability in the DDL component (bsc#1020875)

• CVE-2017-3257: unspecified vulnerability affecting InnoDB (bsc#1020878)

• CVE-2017-3244: unspecified vulnerability affecing the DML component (bsc#1020877)

• CVE-2017-3243: unspecified vulnerability affecting the Charsets component (bsc#1020891)

• CVE-2017-3238: unspecified vulnerability affecting the Optimizer component (bsc#1020882)

• CVE-2016-6664: Root Privilege Escalation (bsc#1008253)

• Applications using the client library for MySQL (libmysqlclient.so) had a use-after-free issue that could cause the applications to crash (bsc#1022428)

• notable changes:

  • XtraDB updated to 5.6.34-79.1
  • TokuDB updated to 5.6.34-79.1
  • Innodb updated to 5.6.35
  • Performance Schema updated to 5.6.35

Release notes and changelog:

• https://kb.askmonty.org/en/mariadb-10029-release-notes
• https://kb.askmonty.org/en/mariadb-10029-changelog

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.5.54 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 16.04 LTS and Ubuntu 16.10 have been updated to MySQL 5.7.17.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-17.html http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html