SUSE-SU-2016:0348-1

Dashboard / Vulnerabilities / SUSE-SU-2016:0348-1

SUSE-SU-2016:0348-1

Summary: Security update for mysql

Details: This update to MySQL 5.5.47 fixes the following issues (bsc#962779): - CVE-2015-7744: Lack of verification against faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack. - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Options. - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect integrity via unknown vectors related to encryption. - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to UDF. - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to privileges. - CVE-2016-0616: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - bsc#959724: Possible buffer overflow from incorrect use of strcpy() and sprintf() The following bugs were fixed: - bsc#960961: Incorrect use of plugin-load option in default_plugins.cnf

References: https://www.suse.com/support/update/announcement/2016/suse-su-20160348-1/, https://bugzilla.suse.com/959724, https://bugzilla.suse.com/960961, https://bugzilla.suse.com/962779, https://www.suse.com/security/cve/CVE-2015-7744, https://www.suse.com/security/cve/CVE-2016-0502, https://www.suse.com/security/cve/CVE-2016-0505, https://www.suse.com/security/cve/CVE-2016-0546, https://www.suse.com/security/cve/CVE-2016-0596, https://www.suse.com/security/cve/CVE-2016-0597, https://www.suse.com/security/cve/CVE-2016-0598, https://www.suse.com/security/cve/CVE-2016-0600, https://www.suse.com/security/cve/CVE-2016-0606, https://www.suse.com/security/cve/CVE-2016-0608, https://www.suse.com/security/cve/CVE-2016-0609, https://www.suse.com/security/cve/CVE-2016-0616