The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to PS. (CVE-2016-0648)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-617:02 advisory.

    MariaDB is a community developed branch of MySQL.
    MariaDB is a multi-user, multi-threaded SQL database server.
    It is a client/server implementation consisting of a server daemon (mysqld)     and many different client programs and libraries. The base package     contains the standard MariaDB/MySQL client programs and generic MySQL files.
    Security issues fixed with this release:
    CVE-2016-0640     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x     before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect     integrity and availability via vectors related to DML.
    CVE-2016-0641     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x     before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect     confidentiality and availability via vectors related to MyISAM.
    CVE-2016-0643     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x     before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     confidentiality via vectors related to DML.
    CVE-2016-0644     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x     before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect     availability via vectors related to DDL.
    CVE-2016-0646     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x     before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect     availability via vectors related to DML.
    CVE-2016-0647     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x     before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to FTS.
    CVE-2016-0648     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x     before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to PS.
    CVE-2016-0649     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x     before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect     availability via vectors related to PS.
    CVE-2016-0650     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x     before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect     availability via vectors related to Replication.
    CVE-2016-0666     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x     before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to Security: Privileges.
    CVE-2016-3452     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x     before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to     affect confidentiality via vectors related to Server: Security:
    Encryption.
    CVE-2016-3477     Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30     and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x     before 10.0.26, and 10.1.x before 10.1.15 allows local users to affect     confidentiality, integrity, and availability via vectors related to     Server: Parser.
    CVE-2016-3521     Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30     and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x     before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated     users to affect availability via vectors related to Server: Types.
    CVE-2016-3615     Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30     and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x     before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated     users to affect availability via vectors related to Server: DML.
    CVE-2016-5440     Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30     and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x     before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators     to affect availability via vectors related to Server: RBR.
    CVE-2016-5444     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x     before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to     affect confidentiality via vectors related to Server: Connection.
    The following packages have been upgraded to a newer upstream version: mariadb (5.5.50).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a newer upstream version:
mariadb (5.5.50).

Security Fix(es) :

* This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory pages, listed in the References section. (CVE-2016-0640, CVE-2016-0641, CVE-2016-0643, CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650, CVE-2016-0666, CVE-2016-3452, CVE-2016-3477, CVE-2016-3521, CVE-2016-3615, CVE-2016-5440, CVE-2016-5444)

The following packages have been upgraded to a newer upstream version:
mariadb (5.5.50).

Security Fix(es) :

(CVE-2016-0640, CVE-2016-0641, CVE-2016-0643, CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650, CVE-2016-0666, CVE-2016-3452, CVE-2016-3477, CVE-2016-3521, CVE-2016-3615, CVE-2016-5440, CVE-2016-5444)

The version of MariaDB installed on the remote host is prior to 10.1.14. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.1.14 advisory.

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to     affect confidentiality via vectors related to Server: Connection. (CVE-2016-5444)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     confidentiality via vectors related to DML. (CVE-2016-0643)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to FTS. (CVE-2016-0647)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier     and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect     availability via vectors related to PS. (CVE-2016-0648)

  - Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x     before 10.0.25 and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to     InnoDB. (CVE-2016-0655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2954-1 advisory.

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to     fix these issues.

    MySQL has been updated to 5.7.12 in Ubuntu 16.04 LTS.

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-12.html     http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0705 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a newer upstream version: rh-mysql56-mysql (5.6.30).

    Security Fix(es):

    * This update fixes several vulnerabilities in the MySQL database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory pages, listed in the References section.
    (CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836,     CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4870, CVE-2015-4890, CVE-2015-4910, CVE-2015-4913,     CVE-2016-0503, CVE-2016-0504, CVE-2016-0505, CVE-2016-0546, CVE-2016-0595, CVE-2016-0596, CVE-2016-0597,     CVE-2016-0598, CVE-2016-0600, CVE-2016-0605, CVE-2016-0606, CVE-2016-0607, CVE-2016-0608, CVE-2016-0609,     CVE-2016-0610, CVE-2016-0611, CVE-2016-0639, CVE-2016-0640, CVE-2016-0641, CVE-2016-0642, CVE-2016-0643,     CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650, CVE-2016-0655,     CVE-2016-0661, CVE-2016-0665, CVE-2016-0666, CVE-2016-0668, CVE-2016-2047)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.30. It is, therefore, affected by multiple vulnerabilities :

  - A cipher algorithm downgrade vulnerability exists in the     bundled version of OpenSSL due to a flaw that is     triggered when handling cipher negotiation. A remote     attacker can exploit this to negotiate SSLv2 ciphers and     complete SSLv2 handshakes even if all SSLv2 ciphers have     been disabled on the server. Note that this     vulnerability only exists if the SSL_OP_NO_SSLv2 option     has not been disabled. (CVE-2015-3197)

  - An unspecified flaw exists in the Pluggable     Authentication subcomponent that allows an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-0639)

  - An unspecified flaw exists in the Federated subcomponent     that allows an authenticated, remote attacker to impact     integrity and availability. (CVE-2016-0642)

  - An unspecified flaw exists in the DML subcomponent that     allows an authenticated, remote attacker to disclose     sensitive information. (CVE-2016-0643)

  - An unspecified flaw exists in the FTS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0647)

  - An unspecified flaw exists in the PS subcomponent that     allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0647)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-0655)

  - An unspecified flaw exists in the Security: Privileges     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2016-0666)

  - A key disclosure vulnerability exists in the bundled     version of OpenSSL due to improper handling of     cache-bank conflicts on the Intel Sandy-bridge     microarchitecture. An attacker can exploit this to gain     access to RSA key information. (CVE-2016-0702)

  - A double-free error exists in the bundled version of     OpenSSL due to improper validation of user-supplied     input when parsing malformed DSA private keys. A remote     attacker can exploit this to corrupt memory, resulting     in a denial of service condition or the execution of     arbitrary code. (CVE-2016-0705)

  - A NULL pointer dereference flaw exists in the bundled     version of OpenSSL in the BN_hex2bn() and BN_dec2bn()     functions. A remote attacker can exploit this to trigger     a heap corruption, resulting in the execution of     arbitrary code. (CVE-2016-0797)

  - A denial of service vulnerability exists in the bundled     version of OpenSSL due to improper handling of invalid     usernames. A remote attacker can exploit this, via a     specially crafted username, to leak 300 bytes of memory     per connection, exhausting available memory resources.
    (CVE-2016-0798)

  - Multiple memory corruption issues exist in the bundled     version of OpenSSL that allow a remote attacker to cause     a denial of service condition or the execution of     arbitrary code. (CVE-2016-0799)

  - A flaw exists in the bundled version of OpenSSL that     allows a cross-protocol Bleichenbacher padding oracle     attack known as DROWN (Decrypting RSA with Obsolete and     Weakened eNcryption). This vulnerability exists due to a     flaw in the Secure Sockets Layer Version 2 (SSLv2)     implementation, and it allows captured TLS traffic to be     decrypted. A man-in-the-middle attacker can exploit this     to decrypt the TLS connection by utilizing previously     captured traffic and weak cryptography along with a     series of specially crafted connections to an SSLv2     server that uses the same private key. (CVE-2016-0800)

  - A man-in-the-middle spoofing vulnerability exists due to     the server hostname not being verified to match a domain     name in the Subject's Common Name (CN) or SubjectAltName     field of the X.509 certificate. A man-in-the-middle     attacker can exploit this, by spoofing the TLS/SSL     server via a certificate that appears valid, to disclose     sensitive information or manipulate transmitted data.
    (CVE-2016-2047)

  - A flaw exists related to certificate validation due to     the server hostname not being verified to match a domain     name in the X.509 certificate. A man-in-the-middle     attacker can exploit this, by spoofing the TLS/SSL     server via a certificate that appears valid, to disclose     sensitive information or manipulate data.

  - An integer overflow condition exists that is triggered     due to improper validation of user-supplied input when     processing client handshakes. An authenticated, remote     attacker can exploit this to cause the server to exit,     resulting in a denial of service condition.

  - An information disclosure vulnerability exists due to     overly verbose error messages returning part of the SQL     statement that produced them. An authenticated, remote     attacker can exploit this to disclose sensitive     information.

A double-free flaw was found in the way OpenSSL parsed certain malformed DSA (Digital Signature Algorithm) private keys. An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash. (CVE-2016-0705)

The ssl_verify_server_cert function in sql-common/client.c in Oracle MySQL 5.6.29 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a '/CN=' string in a field in a certificate, as demonstrated by '/OU=/CN=bar.com/CN=foo.com'. (CVE-2016-2047)

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Pluggable Authentication.
(CVE-2016-0639)

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier allows local users to affect availability via vectors related to FTS.
(CVE-2016-0647)

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier allows local users to affect integrity and availability via vectors related to Federated. (CVE-2016-0642)

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier allows local users to affect confidentiality via vectors related to DML.
(CVE-2016-0643)

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier allows local users to affect availability via vectors related to Security:
Privileges. (CVE-2016-0666)

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier allows local users to affect availability via vectors related to PS.
(CVE-2016-0648)

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier allows local users to affect availability via vectors related to InnoDB.
(CVE-2016-0655)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
219123	Linux Distros Unpatched Vulnerability : CVE-2016-0648	Nessus	Misc.	2025/3/4	2025/8/20	medium
289112	MiracleLinux 7 : mariadb-5.5.50-1.el7 (AXSA:2016-617:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
92950	CentOS 7 : mariadb (CESA-2016:1602)	Nessus	CentOS Local Security Checks	2016/8/15	2026/1/28	high
92996	Scientific Linux Security Update : mariadb on SL7.x x86_64 (20160811)	Nessus	Scientific Linux Local Security Checks	2016/8/17	2026/1/28	high
91766	MariaDB 10.1.0 < 10.1.14 Multiple Vulnerabilities	Nessus	Databases	2016/6/22	2026/1/29	low
90760	Ubuntu 16.04 LTS : MySQL vulnerabilities (USN-2954-1)	Nessus	Ubuntu Local Security Checks	2016/4/27	2024/8/27	critical
234373	RHEL 6 / 7 : rh-mysql56-mysql (RHSA-2016:0705)	Nessus	Red Hat Local Security Checks	2025/4/15	2025/4/15	critical
90683	MySQL 5.6.x < 5.6.30 Multiple Vulnerabilities (DROWN)	Nessus	Databases	2016/4/22	2019/11/20	critical
91239	Amazon Linux AMI : mysql56 (ALAS-2016-701)	Nessus	Amazon Linux Local Security Checks	2016/5/19	2018/4/18	critical

检测

插件搜索

medium

high

high

high

low

critical

critical

critical

critical