Security update for mysql SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2780-1 Final 1 1 2016-11-12T03:12:04Z current 2016-11-12T03:12:04Z 2016-11-12T03:12:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mysql This mysql version update to 5.5.53 fixes the following issues: - CVE-2016-6662: Unspecified vulnerability in subcomponent Logging (bsc#1005580) - CVE-2016-7440: Unspecified vulnerability in subcomponent Encryption (bsc#1005581) - CVE-2016-5584: Unspecified vulnerability in subcomponent Encryption (bsc#1005558) Release Notes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-53.html The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-mysql-12847,slessp4-mysql-12847 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162780-1/ Link for SUSE-SU-2016:2780-1 https://lists.opensuse.org/opensuse-security-announce/2016-11/msg00025.html E-Mail link for SUSE-SU-2016:2780-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1005558 SUSE Bug 1005558 https://bugzilla.suse.com/1005580 SUSE Bug 1005580 https://bugzilla.suse.com/1005581 SUSE Bug 1005581 https://www.suse.com/security/cve/CVE-2016-5584/ SUSE CVE CVE-2016-5584 page https://www.suse.com/security/cve/CVE-2016-6662/ SUSE CVE CVE-2016-6662 page https://www.suse.com/security/cve/CVE-2016-7440/ SUSE CVE CVE-2016-7440 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libmysql55client_r18-32bit-5.5.53-0.30.1 libmysql55client_r18-x86-5.5.53-0.30.1 libmysql55client18-5.5.53-0.30.1 libmysql55client18-32bit-5.5.53-0.30.1 libmysql55client18-x86-5.5.53-0.30.1 libmysql55client_r18-5.5.53-0.30.1 mysql-5.5.53-0.30.1 mysql-client-5.5.53-0.30.1 mysql-tools-5.5.53-0.30.1 libmysql55client18-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 libmysql55client18-32bit-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 libmysql55client18-x86-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 libmysql55client_r18-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 libmysql55client_r18-32bit-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 libmysql55client_r18-x86-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 mysql-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 mysql-client-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 mysql-tools-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 libmysql55client18-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libmysql55client18-32bit-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libmysql55client18-x86-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libmysql55client_r18-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libmysql55client_r18-32bit-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libmysql55client_r18-x86-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mysql-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mysql-client-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 mysql-tools-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libmysql55client_r18-32bit-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libmysql55client_r18-x86-5.5.53-0.30.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Unspecified vulnerability in Oracle MySQL 5.5.52 and earlier, 5.6.33 and earlier, and 5.7.15 and earlier allows remote administrators to affect confidentiality via vectors related to Server: Security: Encryption. CVE-2016-5584 SUSE Linux Enterprise Server 11 SP4:libmysql55client18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client18-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client_r18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client_r18-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client_r18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:mysql-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:mysql-client-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:mysql-tools-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client18-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client_r18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client_r18-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client_r18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mysql-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mysql-client-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mysql-tools-5.5.53-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libmysql55client_r18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libmysql55client_r18-x86-5.5.53-0.30.1 important 4.9 AV:N/AC:H/Au:S/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162780-1/ https://www.suse.com/security/cve/CVE-2016-5584.html CVE-2016-5584 https://bugzilla.suse.com/1005558 SUSE Bug 1005558 https://bugzilla.suse.com/1008318 SUSE Bug 1008318 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15. CVE-2016-6662 SUSE Linux Enterprise Server 11 SP4:libmysql55client18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client18-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client_r18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client_r18-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client_r18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:mysql-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:mysql-client-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:mysql-tools-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client18-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client_r18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client_r18-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client_r18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mysql-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mysql-client-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mysql-tools-5.5.53-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libmysql55client_r18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libmysql55client_r18-x86-5.5.53-0.30.1 important 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162780-1/ https://www.suse.com/security/cve/CVE-2016-6662.html CVE-2016-6662 https://bugzilla.suse.com/1001367 SUSE Bug 1001367 https://bugzilla.suse.com/1005580 SUSE Bug 1005580 https://bugzilla.suse.com/1020873 SUSE Bug 1020873 https://bugzilla.suse.com/1020884 SUSE Bug 1020884 https://bugzilla.suse.com/1021755 SUSE Bug 1021755 https://bugzilla.suse.com/998309 SUSE Bug 998309 The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences. CVE-2016-7440 SUSE Linux Enterprise Server 11 SP4:libmysql55client18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client18-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client_r18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client_r18-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:libmysql55client_r18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:mysql-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:mysql-client-5.5.53-0.30.1 SUSE Linux Enterprise Server 11 SP4:mysql-tools-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client18-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client_r18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client_r18-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libmysql55client_r18-x86-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mysql-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mysql-client-5.5.53-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:mysql-tools-5.5.53-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libmysql55client_r18-32bit-5.5.53-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libmysql55client_r18-x86-5.5.53-0.30.1 important 4 AV:L/AC:H/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162780-1/ https://www.suse.com/security/cve/CVE-2016-7440.html CVE-2016-7440 https://bugzilla.suse.com/1005581 SUSE Bug 1005581 https://bugzilla.suse.com/1008318 SUSE Bug 1008318