svn commit: r431476 - head/security/vuxml
Bernard Spil
brnrd at FreeBSD.org
Sat Jan 14 17:10:59 UTC 2017
Author: brnrd
Date: Sat Jan 14 17:10:58 2017
New Revision: 431476
URL: https://svnweb.freebsd.org/changeset/ports/431476
Log:
security/vuxml: Document multiple MySQL vulnerabilities
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Sat Jan 14 16:29:44 2017 (r431475)
+++ head/security/vuxml/vuln.xml Sat Jan 14 17:10:58 2017 (r431476)
@@ -58,6 +58,124 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="e5186c65-d729-11e6-a9a5-b499baebfeaf">
+ <topic>mysql -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>mysql57-client</name>
+ <name>mysql57-server</name>
+ <range><lt>5.7.15</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>SO-AND-SO reports:</p>
+ <blockquote cite="INSERT URL HERE">
+ <p>Local security vulnerability in 'Server: Packaging' sub component.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>INSERT BLOCKQUOTE URL HERE</url>
+ <cvename>CVE-2016-5625</cvename>
+ </references>
+ <dates>
+ <discovery>2016-10-18</discovery>
+ <entry>2017-01-14</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="22373c43-d728-11e6-a9a5-b499baebfeaf">
+ <topic>MySQL -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>mariadb55-client</name>
+ <name>mariadb55-server</name>
+ <range><lt>5.5.52</lt></range>
+ </package>
+ <package>
+ <name>mariadb100-client</name>
+ <name>mariadb100-server</name>
+ <range><lt>10.0.28</lt></range>
+ </package>
+ <package>
+ <name>mariadb101-client</name>
+ <name>mariadb101-server</name>
+ <range><lt>10.1.18</lt></range>
+ </package>
+ <package>
+ <name>mysql55-client</name>
+ <name>mysql55-server</name>
+ <range><lt>5.5.52</lt></range>
+ </package>
+ <package>
+ <name>mysql56-client</name>
+ <name>mysql56-server</name>
+ <range><lt>5.6.33</lt></range>
+ </package>
+ <package>
+ <name>mysql57-client</name>
+ <name>mysql57-server</name>
+ <range><lt>5.7.15</lt></range>
+ </package>
+ <package>
+ <name>percona55-client</name>
+ <name>percona55-server</name>
+ <range><lt>5.5.51.38.2</lt></range>
+ </package>
+ <package>
+ <name>percona56-client</name>
+ <name>percona56-server</name>
+ <range><lt>5.6.32.78.1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The MySQL project reports:</p>
+ <blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL">
+ <ul>
+ <li>CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer'
+ sub component.</li>
+ <li>CVE-2016-5616, CVE-2016-6663: Race condition allows local users with
+ certain permissions to gain privileges by leveraging use of my_copystat
+ by REPAIR TABLE to repair a MyISAM table.</li>
+ <li>CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based
+ logging, allows local users with access to the mysql account to gain
+ root privileges via a symlink attack on error logs and possibly other
+ files.</li>
+ <li>CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub
+ component.</li>
+ <li>CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub
+ component.</li>
+ <li>CVE-2016-5629: Remote security vulnerability in 'Server: Federated'
+ sub component.</li>
+ <li>CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub
+ component.</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL</url>
+ <url>https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/</url>
+ <url>https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/</url>
+ <url>https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/</url>
+ <cvename>CVE-2016-3492</cvename>
+ <cvename>CVE-2016-5616</cvename>
+ <cvename>CVE-2016-5617</cvename>
+ <cvename>CVE-2016-5624</cvename>
+ <cvename>CVE-2016-5626</cvename>
+ <cvename>CVE-2016-5629</cvename>
+ <cvename>CVE-2016-6663</cvename>
+ <cvename>CVE-2016-6664</cvename>
+ <cvename>CVE-2016-8283</cvename>
+ </references>
+ <dates>
+ <discovery>2016-09-13</discovery>
+ <entry>2017-01-14</entry>
+ </dates>
+ </vuln>
+
<vuln vid="a93c3287-d8fd-11e6-be5c-001fbc0f280f">
<topic>Ansible -- Command execution on Ansible controller from host</topic>
<affects>
More information about the svn-ports-head
mailing list