CVEvulnerability

CVE-2016-6662

9.8 CRITICAL Published 2016-09-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-09-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-264

Description

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

Affected configurations

• oracle mysql (>= 5.5.0 <= 5.5.52) • oracle mysql (>= 5.6.0 <= 5.6.33) • oracle mysql (>= 5.7.0 <= 5.7.15) • percona percona server (>= 5.5 < 5.5.51-38.1) • percona percona server (>= 5.6 < 5.6.32-78.0) • percona percona server (>= 5.7 < 5.7.14-7) • mariadb mariadb (>= 5.5.20 < 5.5.51) • mariadb mariadb (>= 10.0.0 < 10.0.27) • mariadb mariadb (>= 10.1.0 < 10.1.17) • debian debian linux 8.0 • redhat openstack 5.0 • redhat openstack 6.0 • redhat openstack 7.0 • redhat openstack 8 • redhat openstack 9 • redhat enterprise linux 7.0 • redhat enterprise linux desktop 6.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 6.0 • redhat enterprise linux server aus 7.3 • redhat enterprise linux server aus 7.4 • redhat enterprise linux server aus 7.6 • redhat enterprise linux server eus 7.3 • redhat enterprise linux server eus 7.4 • redhat enterprise linux server eus 7.5 • redhat enterprise linux server eus 7.6 • redhat enterprise linux server tus 7.3 • redhat enterprise linux server tus 7.6 • redhat enterprise linux workstation 6.0 • redhat enterprise linux workstation 7.0

Related

Weakness · not in database (1)

References