CVE-2016-6664

Published: 13 December 2016

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.

Priority

Medium

CVSS 3 base score: 7.0

Status

Package Release Status
mariadb-10.0
Launchpad, Ubuntu, Debian
Upstream
Released (10.0.29)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (10.0.29-0ubuntu0.16.04.1)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

mysql-5.5
Launchpad, Ubuntu, Debian
Upstream
Released (5.5.52)
Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr)
Released (5.5.52-0ubuntu0.14.04.1)
mysql-5.6
Launchpad, Ubuntu, Debian
Upstream
Released (5.6.33)
Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was not-affected [5.6.33-0ubuntu0.14.04.1])
mysql-5.7
Launchpad, Ubuntu, Debian
Upstream
Released (5.7.15)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(5.7.15-0ubuntu0.16.04.1)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist