Stay Secure with the Latest Linux Advisories

security advisorycritical issueMySQL

openSUSE Leap 42.1: SU-2016:0367-1 Critical MySQL Threats

An update that fixes 20 vulnerabilities is now available. An update that fixes 20 vulnerabilities is now available. An update that fixes 20 vulnerabilities is now available.. openSUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0367-1 Rating: important References: #957174 #959724 #962779 Cross-References: CVE-2015-5969 CVE-2015-7744 CVE-2016-0502 CVE-2016-0503 CVE-2016-0504 CVE-2016-0505 CVE-2016-0546 CVE-2016-0594 CVE-2016-0595 CVE-2016-0596 CVE-2016-0597 CVE-2016-0598 CVE-2016-0600 CVE-2016-0605 CVE-2016-0606 CVE-2016-0607 CVE-2016-0608 CVE-2016-0609 CVE-2016-0610 CVE-2016-0611 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This update to MySQL 5.6.28 fixes the following issues (bsc#962779): - CVE-2015-7744: Lack of verification against faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack. - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0503: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504. - CVE-2016-0504: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlierand 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503. - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Options. - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. - CVE-2016-0594: Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0595: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0605: Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors. - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect integrity via unknown vectors related to encryption. - CVE-2016-0607: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to replication. - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to UDF. - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to privileges. - CVE-2016-0610: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0611: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2015-5969: Fixed information leak via mysql-systemd-helper script. (bsc#957174) - bsc#959724: Possible buffer overflow from incorrect use of strcpy() and sprintf() Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-165=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-165=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libmysql56client18-5.6.28-13.1 libmysql56client18-debuginfo-5.6.28-13.1 libmysql56client_r18-5.6.28-13.1 mysql-community-server-5.6.28-13.1 mysql-community-server-bench-5.6.28-13.1 mysql-community-server-bench-debuginfo-5.6.28-13.1 mysql-community-server-client-5.6.28-13.1 mysql-community-server-client-debuginfo-5.6.28-13.1 mysql-community-server-debuginfo-5.6.28-13.1 mysql-community-server-debugsource-5.6.28-13.1 mysql-community-server-errormessages-5.6.28-13.1 mysql-community-server-test-5.6.28-13.1 mysql-community-server-test-debuginfo-5.6.28-13.1 mysql-community-server-tools-5.6.28-13.1 mysql-community-server-tools-debuginfo-5.6.28-13.1 - openSUSE Leap 42.1 (x86_64): libmysql56client18-32bit-5.6.28-13.1 libmysql56client18-debuginfo-32bit-5.6.28-13.1 libmysql56client_r18-32bit-5.6.28-13.1 - openSUSE 13.2 (i586 x86_64): libmysql56client18-5.6.28-2.17.1 libmysql56client18-debuginfo-5.6.28-2.17.1 libmysql56client_r18-5.6.28-2.17.1 mysql-community-server-5.6.28-2.17.1 mysql-community-server-bench-5.6.28-2.17.1 mysql-community-server-bench-debuginfo-5.6.28-2.17.1 mysql-community-server-client-5.6.28-2.17.1 mysql-community-server-client-debuginfo-5.6.28-2.17.1 mysql-community-server-debuginfo-5.6.28-2.17.1 mysql-community-server-debugsource-5.6.28-2.17.1 mysql-community-server-errormessages-5.6.28-2.17.1 mysql-community-server-test-5.6.28-2.17.1 mysql-community-server-test-debuginfo-5.6.28-2.17.1 mysql-community-server-tools-5.6.28-2.17.1 mysql-community-server-tools-debuginfo-5.6.28-2.17.1 - openSUSE 13.2 (x86_64): libmysql56client18-32bit-5.6.28-2.17.1 libmysql56client18-debuginfo-32bit-5.6.28-2.17.1 libmysql56client_r18-32bit-5.6.28-2.17.1 References: https://www.suse.com/security/cve/CVE-2015-5969.html https://www.suse.com/security/cve/CVE-2015-7744.html https://www.suse.com/security/cve/CVE-2016-0502.html https://www.suse.com/security/cve/CVE-2016-0503.html https://www.suse.com/security/cve/CVE-2016-0504.html https://www.suse.com/security/cve/CVE-2016-0505.html https://www.suse.com/security/cve/CVE-2016-0546.html https://www.suse.com/security/cve/CVE-2016-0594.html https://www.suse.com/security/cve/CVE-2016-0595.html https://www.suse.com/security/cve/CVE-2016-0596.html https://www.suse.com/security/cve/CVE-2016-0597.html https://www.suse.com/security/cve/CVE-2016-0598.html https://www.suse.com/security/cve/CVE-2016-0600.html https://www.suse.com/security/cve/CVE-2016-0605.html https://www.suse.com/security/cve/CVE-2016-0606.html https://www.suse.com/security/cve/CVE-2016-0607.html https://www.suse.com/security/cve/CVE-2016-0608.html https://www.suse.com/security/cve/CVE-2016-0609.html https://www.suse.com/security/cve/CVE-2016-0610.html https://www.suse.com/security/cve/CVE-2016-0611.html https://bugzilla.suse.com/957174 https://bugzilla.suse.com/959724 https://bugzilla.suse.com/962779 . A crucial security patch for openSUSE addresses 15 severe vulnerabilities in PostgreSQL, including high availability threats and risks of unauthorized data access.. openSUSE MySQL security patch vulnerabilities. . Severity: Important. LinuxSecurity.com Team

Feb 07, 2016 •Important OpenSUSE