The version of MySQL running on the remote host is 5.6.x prior to 5.6.33. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to cause a     denial of service condition. (CVE-2016-5507)

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - An unspecified flaw exists that allows an authenticated,     remote attacker to bypass restrictions and create the     /var/lib/mysql/my.cnf file with custom contents without     the FILE privilege requirement. (CVE-2016-6663)

  - A flaw exists that is related to the use of temporary     files by REPAIR TABLE. An authenticated, remote attacker     can exploit this to gain elevated privileges.

  - A flaw exists in InnoDB when handling an operation that     dropped and created a full-text search table. An     authenticated, remote attacker can exploit this to     trigger an assertion, resulting in a denial of service     condition.

  - A flaw exists in InnoDB when accessing full-text     auxiliary tables while dropping the indexed table. An     authenticated, remote attacker can exploit this to     trigger an assertion, resulting in a denial of service     condition.

  - A buffer overflow condition exists when handling long     integer values in MEDIUMINT columns due to the improper     validation of certain input. An authenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.

  - An unspecified flaw exists due to how a prepared     statement uses a parameter in the select list of a     derived table that was part of a join. An authenticated,     remote attacker can exploit this to cause a server exit,     resulting in a denial of service condition.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix date in the test

  - Fix (CVE-2016-6662, CVE-2016-6663) Resolves: #1397309

  - Fixed reload_acl_and_cache Resolves: #1281370

  - Add support for TLSv1.1 and TLSv1.2

  - Fixed test events_1 (end date in past) Resolves:
    #1287048

According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and     earlier, 5.6.32 and earlier, and 5.7.14 and earlier     allows remote authenticated users to affect     availability via vectors related to Server:
    Optimizer.(CVE-2016-3492)

  - Unspecified vulnerability in Oracle MySQL 5.5.50 and     earlier, 5.6.31 and earlier, and 5.7.13 and earlier     allows remote authenticated users to affect     availability via vectors related to DML.(CVE-2016-5612)

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and     earlier, 5.6.32 and earlier, and 5.7.14 and earlier     allows local users to affect confidentiality,     integrity, and availability via vectors related to     Server: MyISAM.(CVE-2016-5616i1/4%0

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and     earlier allows remote authenticated users to affect     availability via vectors related to     DML.i1/4^CVE-2016-5624i1/4%0

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and     earlier, 5.6.32 and earlier, and 5.7.14 and earlier     allows remote authenticated users to affect     availability via vectors related to     GIS.i1/4^CVE-2016-5626i1/4%0

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and     earlier, 5.6.32 and earlier, and 5.7.14 and earlier     allows remote administrators to affect availability via     vectors related to Server:
    Federated.i1/4^CVE-2016-5629i1/4%0

  - Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and     5.7.x through 5.7.15 MariaDB before 5.5.51, 10.0.x     before 10.0.27, and 10.1.x before 10.1.17 and Percona     Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0,     and 5.7.x before 5.7.14-7 allow local users to create     arbitrary configurations and bypass certain protection     mechanisms by setting general_log_file to a my.cnf     configuration. NOTE: this can be leveraged to execute     arbitrary code with root privileges by setting     malloc_lib.i1/4^CVE-2016-6662i1/4%0

  - A race condition was found in the way MySQL performed     MyISAM engine table repair. A database user with shell     access to the server running mysqld could use this flaw     to change permissions of arbitrary files writable by     the mysql system user.i1/4^CVE-2016-6663i1/4%0

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and     earlier, 5.6.32 and earlier, and 5.7.14 and earlier     allows remote authenticated users to affect     availability via vectors related to Server:
    Types.i1/4^CVE-2016-8283i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2595 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a newer upstream version: mariadb (5.5.52). (BZ#1304516,     BZ#1377974)

    Security Fix(es):

    * It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files.
    An administrative database user, or a database user with FILE privileges, could possibly use this flaw to     run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

    * A race condition was found in the way MariaDB performed MyISAM engine table repair. A database user with     shell access to the server running mysqld could use this flaw to change permissions of arbitrary files     writable by the mysql system user. (CVE-2016-6663)

    * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2016-3492, CVE-2016-5612, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-8283)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for mariadb is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a newer upstream version:
mariadb (5.5.52). (BZ#1304516, BZ#1377974)

Security Fix(es) :

* It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

* A race condition was found in the way MariaDB performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user. (CVE-2016-6663)

* This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
(CVE-2016-3492, CVE-2016-5612, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-8283)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The version of MariaDB installed on the remote host is prior to 5.5.52. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.52 advisory.

  - Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before     8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before     5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before     5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain     permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
    (CVE-2016-6663)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-6663. Reason: This candidate is a     reservation duplicate of CVE-2016-6663. Notes: All CVE users should reference CVE-2016-6663 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage (CVE-2016-5616)

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier     allows remote authenticated users to affect availability via vectors related to Server: Optimizer.
    (CVE-2016-3492)

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect     availability via vectors related to DML. (CVE-2016-5624)

  - Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier     allows remote authenticated users to affect availability via vectors related to GIS. (CVE-2016-5626)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2130 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld,     and many client programs.

    The following packages have been upgraded to a newer upstream version: mysql55-mysql (5.5.52).

    Security Fix(es):

    * It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An     administrative database user, or a database user with FILE privileges, could possibly use this flaw to run     arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662)

    * This update fixes several vulnerabilities in the MySQL database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2016-3492, CVE-2016-5612, CVE-2016-5616, CVE-2016-5617, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629,     CVE-2016-8283)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before     8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before     5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before     5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain     permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
    (CVE-2016-6663)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
93378	MySQL 5.6.x < 5.6.33 Multiple Vulnerabilities	Nessus	Databases	2016/9/8	2020/6/3	critical
96790	OracleVM 3.3 / 3.4 : mysql (OVMSA-2017-0035)	Nessus	OracleVM Local Security Checks	2017/1/26	2026/1/2	critical
99824	EulerOS 2.0 SP1 : mariadb (EulerOS-SA-2016-1062)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	critical
94558	RHEL 7 : mariadb (RHSA-2016:2595)	Nessus	Red Hat Local Security Checks	2016/11/4	2025/8/29	critical
95341	CentOS 7 : mariadb (CESA-2016:2595)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	critical
95633	MariaDB 5.5.0 < 5.5.52 Multiple Vulnerabilities	Nessus	Databases	2016/12/8	2026/1/29	high
258102	RHEL 6 / 7 : mysql55-mysql (RHSA-2016:2130)	Nessus	Red Hat Local Security Checks	2025/8/29	2025/8/29	critical
219862	Linux Distros Unpatched Vulnerability : CVE-2016-6663	Nessus	Misc.	2025/3/4	2026/11/5	high

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

high

critical

high