Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML.

wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, also known as a Lenstra attack.
(CVE-2015-7744)

Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. (CVE-2015-4864)

Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4866)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
(CVE-2015-4861)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2015-4862)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0616)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached. (CVE-2015-4910)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858 . (CVE-2015-4913)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0610)

Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0594)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0595)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0596)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0597)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-0598)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802 . (CVE-2015-4792)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges. (CVE-2015-4791)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via unknown vectors related to Server : Query Cache.
(CVE-2015-4807)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser. (CVE-2015-4870)

Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0599)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. (CVE-2016-0546)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913 .
(CVE-2015-4858)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL. (CVE-2015-4815)

Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition. (CVE-2015-4833)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. (CVE-2015-4830)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP. (CVE-2015-4836)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to UDF. (CVE-2016-0608)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to privileges. (CVE-2016-0609)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Options. (CVE-2016-0505)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503 . (CVE-2016-0504)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication. (CVE-2015-4890)

Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Partition. (CVE-2016-0601)

Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to libmysqld. (CVE-2015-4904)

Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML. (CVE-2015-4905)

Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors.
(CVE-2016-0605)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect integrity via unknown vectors related to encryption. (CVE-2016-0606)

Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect availability via unknown vectors related to Server : Security : Firewall. (CVE-2015-4766)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0611)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to replication. (CVE-2016-0607)

Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs.
(CVE-2015-4819)

Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML.
(CVE-2015-4879)

Unspecified vulnerability in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. (CVE-2016-0502)

Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4895)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504 . (CVE-2016-0503)

Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. (CVE-2016-0600)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792 . (CVE-2015-4802)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. (CVE-2015-4800)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types. (CVE-2015-4826)

This update to MySQL 5.6.28 fixes the following issues (bsc#962779) :

  - CVE-2015-7744: Lack of verification against faults     associated with the Chinese Remainder Theorem (CRT)     process when allowing ephemeral key exchange without low     memory optimizations on a server, which makes it easier     for remote attackers to obtain private RSA keys by     capturing TLS handshakes, aka a Lenstra attack.

  - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL     5.5.31 and earlier and 5.6.11 and earlier allows remote     authenticated users to affect availability via unknown     vectors related to Optimizer. 

  - CVE-2016-0503: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via vectors related to DML,     a different vulnerability than CVE-2016-0504. 

  - CVE-2016-0504: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via vectors related to DML,     a different vulnerability than CVE-2016-0503. 

  - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to Options. 

  - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     local users to affect confidentiality, integrity, and     availability via unknown vectors related to Client. 

  - CVE-2016-0594: Unspecified vulnerability in Oracle MySQL     5.6.21 and earlier allows remote authenticated users to     affect availability via vectors related to DML. 

  - CVE-2016-0595: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier allows remote authenticated users to     affect availability via vectors related to DML. 

  - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier and 5.6.27 and earlier allows remote     authenticated users to affect availability via vectors     related to DML. 

  - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to Optimizer. 

  - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     vectors related to DML. 

  - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to InnoDB. 

  - CVE-2016-0605: Unspecified vulnerability in Oracle MySQL     5.6.26 and earlier allows remote authenticated users to     affect availability via unknown vectors. 

  - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect integrity via     unknown vectors related to encryption. 

  - CVE-2016-0607: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via unknown vectors related     to replication. 

  - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     vectors related to UDF. 

  - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to privileges. 

  - CVE-2016-0610: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier allows remote authenticated users to     affect availability via unknown vectors related to     InnoDB. 

  - CVE-2016-0611: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via unknown vectors related     to Optimizer.

  - bsc#959724: Possible buffer overflow from incorrect use     of strcpy() and sprintf()

This update to MySQL 5.6.28 fixes the following issues (bsc#962779) :

  - CVE-2015-7744: Lack of verification against faults     associated with the Chinese Remainder Theorem (CRT)     process when allowing ephemeral key exchange without low     memory optimizations on a server, which makes it easier     for remote attackers to obtain private RSA keys by     capturing TLS handshakes, aka a Lenstra attack.

  - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL     5.5.31 and earlier and 5.6.11 and earlier allows remote     authenticated users to affect availability via unknown     vectors related to Optimizer. 

  - CVE-2016-0503: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via vectors related to DML,     a different vulnerability than CVE-2016-0504. 

  - CVE-2016-0504: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via vectors related to DML,     a different vulnerability than CVE-2016-0503. 

  - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to Options. 

  - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     local users to affect confidentiality, integrity, and     availability via unknown vectors related to Client. 

  - CVE-2016-0594: Unspecified vulnerability in Oracle MySQL     5.6.21 and earlier allows remote authenticated users to     affect availability via vectors related to DML. 

  - CVE-2016-0595: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier allows remote authenticated users to     affect availability via vectors related to DML. 

  - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier and 5.6.27 and earlier allows remote     authenticated users to affect availability via vectors     related to DML. 

  - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to Optimizer. 

  - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     vectors related to DML. 

  - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to InnoDB. 

  - CVE-2016-0605: Unspecified vulnerability in Oracle MySQL     5.6.26 and earlier allows remote authenticated users to     affect availability via unknown vectors. 

  - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect integrity via     unknown vectors related to encryption. 

  - CVE-2016-0607: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via unknown vectors related     to replication. 

  - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     vectors related to UDF. 

  - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to privileges. 

  - CVE-2016-0610: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier allows remote authenticated users to     affect availability via unknown vectors related to     InnoDB. 

  - CVE-2016-0611: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via unknown vectors related     to Optimizer.

  - CVE-2015-5969: Fixed information leak via     mysql-systemd-helper script. (bsc#957174)

  - bsc#959724: Possible buffer overflow from incorrect use     of strcpy() and sprintf()

The version of Oracle MySQL installed on the remote host is 5.6.x prior to 5.6.22. It is, therefore, affected by an unspecified flaw in the DML subcomponent. An authenticated, remote attacker can exploit this to cause a denial of service condition.

The version of MySQL installed on the remote host is version 5.5.x prior to 5.5.41 or 5.6.x prior to 5.6.22. It is, therefore, affected by vulnerabilities in the following components :

  - Server : DDL
  - Server : InnoDB : DDL : Foreign Key
  - Server : InnoDB : DML
  - Server : Optimizer
  - Server : Pluggable Auth
  - Server : Replication
  - Server : Security : Encryption
  - Server : Security : Privileges : Foreign Key

ID	Name	Product	Family	Severity
90366	Amazon Linux AMI : mysql56 (ALAS-2016-684)	Nessus	Amazon Linux Local Security Checks	medium
88633	openSUSE Security Update : MySQL (openSUSE-2016-169)	Nessus	SuSE Local Security Checks	medium
88616	openSUSE Security Update : MySQL (openSUSE-2016-165)	Nessus	SuSE Local Security Checks	medium
88382	Oracle MySQL 5.6.x < 5.6.22 DML DoS (January 2016 CPU)	Nessus	Databases	medium
80886	MySQL 5.5.x < 5.5.41 / 5.6.x < 5.6.22 Multiple Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2016-0594

medium

Tenable Plugins

medium

medium

medium

medium

high