CVE-2016-0651
published 2016-04-21CVE-2016-0651: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
1.23%
65.4th percentile
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb | mariadb | >= 10.0.0 < 10.0.23 | 10.0.23 |
| mariadb | mariadb | >= 10.1.0 < 10.1.10 | 10.1.10 |
| mariadb | mariadb | >= 5.5.0 < 5.5.47 | 5.5.47 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| oracle | mysql | 5.5.0 – 5.5.46 | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise_debuginfo | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:N/A:P
osv5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)
vendor_redhat·2016-04-21·CVSS 5.5
CVE-2016-0651 [MEDIUM] mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)
mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
Package: mysql55-mysql (Red Hat Enterprise Linux 5) - Will not fix
Package: mysql (Red Hat Enterprise Linux 6) - Under investigation
Package: mariadb-galera (Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)) - Will not fix
Package: mariadb-galera (Red Hat Enterprise Linux OpenStack Platform 6 (Juno)) - Will not fix
Package: mariadb-galera (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)) - Will not fix
Package: mariadb-galera (Red Hat OpenStack Platform 8 (Liberty)) - Will not fix
Package: rh-mariadb101-mariadb (Red Hat Software Collections) - Not aff
GHSA
GHSA-f28w-g82h-6rwv: Unspecified vulnerability in Oracle MySQL 5
ghsa_unreviewed·2022-05-14
CVE-2016-0651 [MEDIUM] GHSA-f28w-g82h-6rwv: Unspecified vulnerability in Oracle MySQL 5
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
OSV
CVE-2016-0651: Unspecified vulnerability in Oracle MySQL 5
osv·2016-04-21·CVSS 5.5
CVE-2016-0651 [MEDIUM] CVE-2016-0651: Unspecified vulnerability in Oracle MySQL 5
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-0651 mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)
bugzilla·2016-04-21·CVSS 5.5
CVE-2016-0651 [MEDIUM] CVE-2016-0651 mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)
CVE-2016-0651 mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.46 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
External References:
http://www.oracle.com/technetwork/topics/security/cpuapr2016verbose-2881709.html
Discussion:
MariaDB upstream indicates that this issue was fixed in version 5.5.47:
https://mariadb.com/kb/en/mariadb/mariadb-554
Bugzilla
CVE-2016-0686 OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952)
bugzilla·2016-04-15·CVSS 9.6
CVE-2016-0686 [CRITICAL] CVE-2016-0686 OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952)
CVE-2016-0686 OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952)
It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Critical Patch Update - April 2016. Fixed in Oracle Java SE 6u115, 7u101, and 8u91.
External References:
http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html#AppendixJAVA
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2016:0651 https://rhn.redhat.com/errata/RHSA-2016-0651.html
---
This issue has been ad
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00033.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00034.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00051.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00053.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0534.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1480.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1481.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://www.securitytracker.com/id/1035606https://access.redhat.com/errata/RHSA-2016:1132http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00033.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00034.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00051.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00053.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0534.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1480.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1481.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://www.securitytracker.com/id/1035606https://access.redhat.com/errata/RHSA-2016:1132
2016-04-21
Published