The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3629-1 advisory.

    Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to     fix these issues.

    MySQL has been updated to 5.5.60 in Ubuntu 14.04 LTS. Ubuntu 16.04 LTS, and Ubuntu 17.10 have been updated     to MySQL 5.7.22.

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-60.html     http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-22.html     http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3629-3 advisory.

    USN-3629-1 fixed vulnerabilities in MySQL. This update provides the corresponding updates for Ubuntu 18.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

**MySQL 5.7.22**

**Changelog**

https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-22.html

**CVEs fixed**

CVE-2018-2755 CVE-2018-2758 CVE-2018-2759 CVE-2018-2761 CVE-2018-2762 CVE-2018-2766 CVE-2018-2769 CVE-2018-2771 CVE-2018-2773 CVE-2018-2775 CVE-2018-2776 CVE-2018-2777 CVE-2018-2778 CVE-2018-2779 CVE-2018-2780 CVE-2018-2781 CVE-2018-2782 CVE-2018-2784 CVE-2018-2786 CVE-2018-2787 CVE-2018-2810 CVE-2018-2812 CVE-2018-2813 CVE-2018-2816 CVE-2018-2817 CVE-2018-2818 CVE-2018-2819 CVE-2018-2839 CVE-2018-2846

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MariaDB was updated to 10.0.35 (bsc#1090518) Notable changes :

  - PCRE updated to 8.42

  - XtraDB updated to 5.6.39-83.1

  - TokuDB updated to 5.6.39-83.1

  - InnoDB updated to 5.6.40

  - The embedded server library now supports SSL when     connecting to remote servers [bsc#1088681],     [CVE-2018-2767]

  - MDEV-15249 - Crash in MVCC read after IMPORT TABLESPACE

  - MDEV-14988 - innodb_read_only tries to modify files if     transactions were recovered in COMMITTED state

  - MDEV-14773 - DROP TABLE hangs for InnoDB table with     FULLTEXT index

  - MDEV-15723 - Crash in     INFORMATION_SCHEMA.INNODB_SYS_TABLES when accessing     corrupted record

  - fixes for the following security vulnerabilities:
    CVE-2018-2782, CVE-2018-2784, CVE-2018-2787,     CVE-2018-2766, CVE-2018-2755, CVE-2018-2819,     CVE-2018-2817, CVE-2018-2761, CVE-2018-2781,     CVE-2018-2771, CVE-2018-2813

  - Release notes and changelog :

    - https://kb.askmonty.org/en/mariadb-10035-release-notes

    - https://kb.askmonty.org/en/mariadb-10035-changelog

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MariaDB to version 10.0.35 fixes multiple issues:
Security issues fixed :

  - CVE-2018-2782: Unspecified DoS vulnerability in InnoDB     (bsc#1090518)

  - CVE-2018-2784: Unspecified DoS vulnerability in InnoDB     (bsc#1090518)

  - CVE-2018-2787: Unspecified vulnerability in InnoDB     allowing writes (bsc#1090518)

  - CVE-2018-2766: Unspecified DoS vulnerability InnoDB     (bsc#1090518)

  - CVE-2018-2755: Unspecified vulnerability in Replication     allowing server compromise (bsc#1090518)

  - CVE-2018-2819: Unspecified DoS vulnerability in InnoDB     (bsc#1090518)

  - CVE-2018-2817: Unspecified DoS vulnerability in DDL     (bsc#1090518)

  - CVE-2018-2761: Unspecified DoS vulnerability in Client     programs (bsc#1090518)

  - CVE-2018-2781: Unspecified DoS vulnerability in     Server/Optimizer (bsc#1090518)

  - CVE-2018-2771: Unspecified DoS vulnerability in the     Server/Locking component (bsc#1090518)

  - CVE-2018-2813: Unspecified vulnerability in The DDL     component allowing unauthorized reads (bsc#1090518)

  - CVE-2018-2767: The embedded server library now supports     SSL when connecting to remote servers (bsc#1088681)

The following changes are included :

  - XtraDB updated to 5.6.39-83.1

  - TokuDB updated to 5.6.39-83.1

  - InnoDB updated to 5.6.40

  - Fix for Crash in MVCC read after IMPORT TABLESPACE

  - Fix for innodb_read_only trying to modify files if     transactions were recovered in COMMITTED state

  - Fix for DROP TABLE hang on InnoDB table with FULLTEXT     index

  - Fix for Crash in INFORMATION_SCHEMA.INNODB_SYS_TABLES     whenaccessing corrupted record

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The version of MariaDB installed on the remote host is prior to 10.1.33. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-10133-release-notes advisory.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions     that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of     MySQL Server accessible data. (CVE-2018-2787)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported     versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to     exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server     executes to compromise MySQL Server. Successful attacks require human interaction from a person other than     the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional     products. Successful attacks of this vulnerability can result in takeover of MySQL Server. (CVE-2018-2755)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported     versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-2761)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions     that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2018-2766)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption).
    Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior.
    Difficult to exploit vulnerability allows low privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of MySQL Server accessible data. (CVE-2018-2767)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for mariadb to version 10.2.15 fixes the following issues :

These security issues were fixed :

  - CVE-2018-2767: Enforse use of SSL/TLS in embedded server     library (Return of BACKRONYM) (bsc#1088681).

  - CVE-2018-2786: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB). Easily     exploitable vulnerability allowed high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server as well as unauthorized update,     insert or delete access to some of MySQL Server     accessible data (bsc#1089987).

  - CVE-2018-2759: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB). Easily     exploitable vulnerability allowed high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server (bsc#1089987).

  - CVE-2018-2777: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB). Easily     exploitable vulnerability allowed high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server (bsc#1089987).

  - CVE-2018-2810: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB). Easily     exploitable vulnerability allowed high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server (bsc#1089987).

  - CVE-2018-2782: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB). Easily     exploitable vulnerability allowed low privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server (bsc#1089987, bsc#1090518).

  - CVE-2018-2784: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB). Easily     exploitable vulnerability allowed low privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server (bsc#1089987, bsc#1090518).

  - CVE-2018-2787: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB). Easily     exploitable vulnerability allowed high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server as well as unauthorized update,     insert or delete access to some of MySQL Server     accessible data (bsc#1089987, bsc#1090518).

  - CVE-2018-2766: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB). Easily     exploitable vulnerability allowed high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server (bsc#1089987, bsc#1090518).

  - CVE-2018-2755: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server:
    Replication). Difficult to exploit vulnerability allowed     unauthenticated attacker with logon to the     infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks require human     interaction from a person other than the attacker and     while the vulnerability is in MySQL Server, attacks may     significantly impact additional products. Successful     attacks of this vulnerability can result in takeover of     MySQL Server (bsc#1089987, bsc#1090518).

  - CVE-2018-2819: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB). Easily     exploitable vulnerability allowed low privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server (bsc#1089987, bsc#1090518).

  - CVE-2018-2817: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server: DDL).
    Easily exploitable vulnerability allowed low privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server (bsc#1089987, bsc#1090518).

  - CVE-2018-2761: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Client     programs). Difficult to exploit vulnerability allowed     unauthenticated attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server     (bsc#1089987, bsc#1090518).

  - CVE-2018-2781: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server:
    Optimizer). Easily exploitable vulnerability allowed     high privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server     (bsc#1089987, bsc#1090518).

  - CVE-2018-2771: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server:
    Locking). Difficult to exploit vulnerability allowed     high privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server     (bsc#1089987, bsc#1090518).

  - CVE-2018-2813: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server: DDL).
    Easily exploitable vulnerability allowed low privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of MySQL Server accessible data (bsc#1089987,     bsc#1090518).

These non-security issues were fixed :

  - PCRE updated to 8.42

  - Incomplete validation of missing tablespace during     recovery

  - ib_buffer_pool unnecessarily includes the temporary     tablespace

  - InnoDB may write uninitialized garbage to redo log

  - Virtual Columns: Assertion failed in     dict_table_get_col_name

  - slow innodb startup/shutdown can exceed systemd timeout

  - Assertion failed in dict_check_sys_tables on upgrade     from 5.5

  - Change buffer crash during TRUNCATE or DROP TABLE

  - temporary table ROLLBACK fixes

For additional details please see

- https://mariadb.com/kb/en/library/mariadb-10215-release-notes

- https://mariadb.com/kb/en/library/mariadb-10215-changelog

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions     that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of     MySQL Server accessible data. (CVE-2018-2787)

Note that Nessus relies on the presence of the package as reported by the vendor.

MariaDB was updated to 10.0.35 (bsc#1090518)

Notable changes :

PCRE updated to 8.42

XtraDB updated to 5.6.39-83.1

TokuDB updated to 5.6.39-83.1

InnoDB updated to 5.6.40

The embedded server library now supports SSL when connecting to remote servers [bsc#1088681], [CVE-2018-2767]

MDEV-15249 - Crash in MVCC read after IMPORT TABLESPACE

MDEV-14988 - innodb_read_only tries to modify files if transactions were recovered in COMMITTED state

MDEV-14773 - DROP TABLE hangs for InnoDB table with FULLTEXT index

MDEV-15723 - Crash in INFORMATION_SCHEMA.INNODB_SYS_TABLES when accessing corrupted record

fixes for the following security vulnerabilities: CVE-2018-2782, CVE-2018-2784, CVE-2018-2787, CVE-2018-2766, CVE-2018-2755, CVE-2018-2819, CVE-2018-2817, CVE-2018-2761, CVE-2018-2781, CVE-2018-2771, CVE-2018-2813

Release notes and changelog :

    - https://kb.askmonty.org/en/mariadb-10035-release-notes

    - https://kb.askmonty.org/en/mariadb-10035-changelog

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.40. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.22. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

The version of MySQL running on the remote host is 5.5.x prior to 5.5.60. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
109311	Ubuntu 14.04 LTS / 16.04 LTS : MySQL vulnerabilities (USN-3629-1)	Nessus	Ubuntu Local Security Checks	2018/4/24	2024/8/27	high
109467	Ubuntu 18.04 LTS : MySQL vulnerabilities (USN-3629-3)	Nessus	Ubuntu Local Security Checks	2018/5/1	2024/10/29	high
109563	Fedora 26 : community-mysql (2018-8b920c2b00)	Nessus	Fedora Local Security Checks	2018/5/4	2024/10/11	high
110089	SUSE SLES12 Security Update : mariadb (SUSE-SU-2018:1382-1)	Nessus	SuSE Local Security Checks	2018/5/24	2024/10/1	high
110679	openSUSE Security Update : mariadb (openSUSE-2018-668)	Nessus	SuSE Local Security Checks	2018/6/25	2024/9/16	high
167883	MariaDB 10.1.0 < 10.1.33 Multiple Vulnerabilities	Nessus	Databases	2022/11/18	2025/7/17	high
123187	openSUSE Security Update : mariadb (openSUSE-2019-427)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/12	high
251389	Linux Distros Unpatched Vulnerability : CVE-2018-2787	Nessus	Misc.	2025/8/18	2025/8/18	medium
118270	SUSE SLES12 Security Update : mariadb (SUSE-SU-2018:1781-2)	Nessus	SuSE Local Security Checks	2018/10/22	2024/7/30	high
700621	MySQL 5.6.x < 5.6.40 Multiple Vulnerabilities (April 2018 CPU)	Nessus Network Monitor	Database	2019/4/25	2019/4/25	high
700626	MySQL 5.7.x < 5.7.22 Multiple Vulnerabilities (April 2018 CPU)	Nessus Network Monitor	Database	2019/4/25	2019/4/25	high
700615	MySQL 5.5.x < 5.5.60 Multiple Vulnerabilities (April 2018 CPU)	Nessus Network Monitor	Database	2019/4/25	2019/4/25	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

medium

high

high

high

high