This update fixes the following issues :

  - Update to 5.5.60 in Oracle Apr2018 CPU (bsc#1089987).

  - CVE-2018-2761: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Client     programs). Supported versions that are affected are     5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. CVSS     3.0 Base Score 5.9 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

  - CVE-2018-2755: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server:
    Replication). Supported versions that are affected are     5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior.
    Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the     infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks require human     interaction from a person other than the attacker and     while the vulnerability is in MySQL Server, attacks may     significantly impact additional products. Successful     attacks of this vulnerability can result in takeover of     MySQL Server. CVSS 3.0 Base Score 7.7 (Confidentiality,     Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

  - CVE-2018-2781: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server:
    Optimizer). Supported versions that are affected are     5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior.
    Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.0 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

  - CVE-2018-2819: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: InnoDB).
    Supported versions that are affected are 5.5.59 and     prior, 5.6.39 and prior and 5.7.21 and prior. Easily     exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 6.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

  - CVE-2018-2818: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server :
    Security : Privileges). Supported versions that are     affected are 5.5.59 and prior, 5.6.39 and prior and     5.7.21 and prior. Easily exploitable vulnerability     allows high privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. CVSS     3.0 Base Score 4.9 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

  - CVE-2018-2817: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server: DDL).
    Supported versions that are affected are 5.5.59 and     prior, 5.6.39 and prior and 5.7.21 and prior. Easily     exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.0 Base Score 6.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

  - CVE-2018-2771: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server:
    Locking). Supported versions that are affected are     5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior.
    Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.0 Base Score 4.4     (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

  - CVE-2018-2813: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Server: DDL).
    Supported versions that are affected are 5.5.59 and     prior, 5.6.39 and prior and 5.7.21 and prior. Easily     exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized read access to a subset of     MySQL Server accessible data. CVSS 3.0 Base Score 4.3     (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

  - CVE-2018-2773: Vulnerability in the MySQL Server     component of Oracle MySQL (subcomponent: Client     programs). Supported versions that are affected are     5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior.
    Difficult to exploit vulnerability allows high     privileged attacker with logon to the infrastructure     where MySQL Server executes to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. CVSS     3.0 Base Score 4.1 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

SUSE SLES11 Security Update : mysql (SUSE-SU-2018:1333-1)

high Nessus Plugin ID 109938

Version 1.7