The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2130 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a newer upstream version: mysql55-mysql (5.5.52).

    Security Fix(es):

    * It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An     administrative database user, or a database user with FILE privileges, could possibly use this flaw to run     arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

    * This update fixes several vulnerabilities in the MySQL database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2016-3492, CVE-2016-5612, CVE-2016-5616, CVE-2016-5617, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629,     CVE-2016-8283)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for mysql is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

Security Fix(es) :

* It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

* A race condition was found in the way MySQL performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user. (CVE-2016-6663, CVE-2016-5616)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2131 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is     binary-compatible with MySQL.

    The following packages have been upgraded to a newer upstream version: mariadb55-mariadb (5.5.53).

    Security Fix(es):

    * It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files.
    An administrative database user, or a database user with FILE privileges, could possibly use this flaw to     run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

    * A race condition was found in the way MariaDB performed MyISAM engine table repair. A database user with     shell access to the server running mysqld could use this flaw to change permissions of arbitrary files     writable by the mysql system user. (CVE-2016-6663)

    * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2016-3492, CVE-2016-5612, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-8283)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2928 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is     binary-compatible with MySQL.

    The following packages have been upgraded to a newer upstream version: rh-mariadb101-mariadb (10.1.19).

    Security Fix(es):

    * It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files.
    An administrative database user, or a database user with FILE privileges, could possibly use this flaw to     run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

    * A race condition was found in the way MariaDB performed MyISAM engine table repair. A database user with     shell access to the server running mysqld could use this flaw to change permissions of arbitrary files     writable by the mysql system user. (CVE-2016-6663, CVE-2016-5616)

    * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2016-3492, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-8283)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-1178:02 advisory.

    MariaDB is a community developed branch of MySQL.
    MariaDB is a multi-user, multi-threaded SQL database server.
    It is a client/server implementation consisting of a server daemon (mysqld)     and many different client programs and libraries. The base package     contains the standard MariaDB/MySQL client programs and generic MySQL files.
    Security issues fixed with this release:
    CVE-2016-3492     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote authenticated users     to affect availability via vectors related to Server: Optimizer.
    CVE-2016-5616     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows local users to affect     confidentiality, integrity, and availability via vectors related to     Server: MyISAM.
    CVE-2016-5624     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows     remote authenticated users to affect availability via vectors related     to DML.
    CVE-2016-5626     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote authenticated users     to affect availability via vectors related to GIS.
    CVE-2016-5629     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote administrators to     affect availability via vectors related to Server: Federated.
    CVE-2016-6662     Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through     5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x     before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before     5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create     arbitrary configurations and bypass certain protection mechanisms by     setting general_log_file to a my.cnf configuration.  NOTE: this can be     leveraged to execute arbitrary code with root privileges by setting     malloc_lib.
    CVE-2016-6663
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-8283     Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32     and earlier, and 5.7.14 and earlier allows remote authenticated users     to affect availability via vectors related to Server: Types.
    The following packages have been upgraded to a newer upstream version: rh-mariadb101-mariadb (10.1.19).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MariaDB installed on the remote host is prior to 10.0.28. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.28 advisory.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported     versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Difficult to     exploit vulnerability allows high privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server.
    Note: CVE-2017-3600 is equivalent to CVE-2016-5483. (CVE-2017-3600)

  - Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before     8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before     5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before     5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain     permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
    (CVE-2016-6663)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-6663. Reason: This candidate is a     reservation duplicate of CVE-2016-6663. Notes: All CVE users should reference CVE-2016-6663 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage (CVE-2016-5616)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-3600. Reason: This candidate is a     reservation duplicate of CVE-2017-3600. Notes: All CVE users should reference CVE-2017-3600 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage (CVE-2016-5483)

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier     allows remote authenticated users to affect availability via vectors related to Server: Optimizer.
    (CVE-2016-3492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This mariadb update to version 10.0.28 fixes the following issues (bsc#1008318) :

Security fixes :

  - CVE-2016-8283: Unspecified vulnerability in subcomponent     Types (bsc#1005582)

  - CVE-2016-7440: Unspecified vulnerability in subcomponent     Encryption (bsc#1005581)

  - CVE-2016-5629: Unspecified vulnerability in subcomponent     Federated (bsc#1005569)

  - CVE-2016-5626: Unspecified vulnerability in subcomponent     GIS (bsc#1005566)

  - CVE-2016-5624: Unspecified vulnerability in subcomponent     DML (bsc#1005564)

  - CVE-2016-5616: Unspecified vulnerability in subcomponent     MyISAM (bsc#1005562)

  - CVE-2016-5584: Unspecified vulnerability in subcomponent     Encryption (bsc#1005558)

  - CVE-2016-3492: Unspecified vulnerability in subcomponent     Optimizer (bsc#1005555)

  - CVE-2016-6663: Privilege Escalation / Race Condition     (bsc#1001367)

Bugfixes :

  - mysql_install_db can't find data files (bsc#1006539)

  - mariadb failing test sys_vars.optimizer_switch_basic     (bsc#1003800)

  - Remove useless mysql@default.service (bsc#1004477)

  - Replace all occurrences of the string '@sysconfdir@'     with '/etc' as it wasn't expanded properly (bsc#990890)

  - Notable changes :

  - XtraDB updated to 5.6.33-79.0

  - TokuDB updated to 5.6.33-79.0

  - Innodb updated to 5.6.33

  - Performance Schema updated to 5.6.33

  - Release notes and upstream changelog :

  - https://kb.askmonty.org/en/mariadb-10028-release-notes

  - https://kb.askmonty.org/en/mariadb-10028-changelog

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0184 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld)     and many client programs and libraries.

    Security Fix(es):

    * It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An     administrative database user, or a database user with FILE privileges, could possibly use this flaw to run     arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

    * A race condition was found in the way MySQL performed MyISAM engine table repair. A database user with     shell access to the server running mysqld could use this flaw to change permissions of arbitrary files     writable by the mysql system user. (CVE-2016-6663, CVE-2016-5616)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
258102	RHEL 6 / 7 : mysql55-mysql (RHSA-2016:2130)	Nessus	Red Hat Local Security Checks	2025/8/29	2025/8/29	critical
101415	Virtuozzo 6 : mysql / mysql-bench / mysql-devel / mysql-embedded / etc (VZLSA-2017-0184)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	critical
258103	RHEL 6 / 7 : mariadb55-mariadb (RHSA-2016:2131)	Nessus	Red Hat Local Security Checks	2025/8/29	2025/8/29	critical
258104	RHEL 6 / 7 : rh-mariadb101-mariadb (RHSA-2016:2928)	Nessus	Red Hat Local Security Checks	2025/8/29	2025/8/29	critical
289106	MiracleLinux 7 : rh-mariadb101-mariadb-10.1.19-6.el7 (AXSA:2016-1178:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
95540	MariaDB 10.0.0 < 10.0.28 Multiple Vulnerabilities	Nessus	Databases	2016/12/5	2026/1/29	high
95597	openSUSE Security Update : mariadb (openSUSE-2016-1417)	Nessus	SuSE Local Security Checks	2016/12/7	2026/1/15	high
96756	RHEL 6 : mysql (RHSA-2017:0184)	Nessus	Red Hat Local Security Checks	2017/1/25	2025/8/29	critical

检测

插件搜索

critical

critical

critical

critical

critical

high

high

critical