CVE-2017-3302: Use After Free
First published: Sun Feb 12 2017(Updated: )
A use-after-free flaw was found in the MySQL client library (libmysqlclient.so). A malicious MySQL server could cause an application using the MySQL client library to crash. Upstream bugs: <a href="https://bugs.mysql.com/bug.php?id=70429">https://bugs.mysql.com/bug.php?id=70429</a> <a href="https://bugs.mysql.com/bug.php?id=63363">https://bugs.mysql.com/bug.php?id=63363</a> Upstream patch: <a href="https://github.com/mysql/mysql-server/commit/4797ea0b772d5f4c5889bc552424132806f46e93">https://github.com/mysql/mysql-server/commit/4797ea0b772d5f4c5889bc552424132806f46e93</a>
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle MySQL | >=5.6.0<5.6.21 | |
| Oracle MySQL | >=5.7.0<5.7.5 | |
| Mariadb Mariadb | <=5.5.54 | |
| Mariadb Mariadb | >=10.0.0<=10.0.29 | |
| Mariadb Mariadb | >=10.1.0<=10.1.21 | |
| Mariadb Mariadb | >=10.2.0<=10.2.3 | |
| Debian Debian Linux | =8.0 | |
| Redhat Enterprise Linux Desktop | =7.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Server Aus | =7.4 | |
| Redhat Enterprise Linux Server Aus | =7.6 | |
| Redhat Enterprise Linux Server Eus | =7.4 | |
| Redhat Enterprise Linux Server Eus | =7.5 | |
| Redhat Enterprise Linux Server Eus | =7.6 | |
| Redhat Enterprise Linux Workstation | =7.0 | |
| redhat/mysql | <5.5.55 | 5.5.55 |
| redhat/mysql | <5.6.21 | 5.6.21 |
| redhat/mysql | <5.7.5 | 5.7.5 |
| redhat/mariadb | <10.0.30 | 10.0.30 |
| redhat/mariadb | <10.1.22 | 10.1.22 |
| redhat/mariadb | <10.2.5 | 10.2.5 |
| redhat/mariadb | <5.5.55 | 5.5.55 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.debian.org/security/2017/dsa-3809
- http://www.debian.org/security/2017/dsa-3834
- http://www.openwall.com/lists/oss-security/2017/02/11/11
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
- http://www.securityfocus.com/bid/96162
- http://www.securitytracker.com/id/1038287
- https://access.redhat.com/errata/RHSA-2017:2192
- https://access.redhat.com/errata/RHSA-2017:2787
- https://access.redhat.com/errata/RHSA-2018:0279
- https://access.redhat.com/errata/RHSA-2018:0574
- https://bugs.mysql.com/bug.php?id=70429
- https://bugs.mysql.com/bug.php?id=63363
- https://github.com/mysql/mysql-server/commit/4797ea0b772d5f4c5889bc552424132806f46e93
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1422122
- http://www.openwall.com/lists/oss-security/2017/01/28/1
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixMSQL
- https://jira.mariadb.org/browse/MDEV-11933
- https://github.com/MariaDB/server/commit/eef21014898d61e77890359d6546d4985d829ef6
- https://bugzilla.redhat.com/show_bug.cgi?id=1422119
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-3302
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/remedy
- agent/references
- agent/author
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/oracle
- canonical/oracle mysql
- version/oracle mysql/5.6.0
- version/oracle mysql/5.7.0
- vendor/mariadb
- canonical/mariadb mariadb
- version/mariadb mariadb/5.5.54
- version/mariadb mariadb/10.0.0
- version/mariadb mariadb/10.0.29
- version/mariadb mariadb/10.1.0
- version/mariadb mariadb/10.1.21
- version/mariadb mariadb/10.2.0
- version/mariadb mariadb/10.2.3
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux server aus
- version/redhat enterprise linux server aus/7.4
- version/redhat enterprise linux server aus/7.6
- canonical/redhat enterprise linux server eus
- version/redhat enterprise linux server eus/7.4
- version/redhat enterprise linux server eus/7.5
- version/redhat enterprise linux server eus/7.6
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/7.0
- package-manager/redhat