Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2016-5440 |
CWE-ID | CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
MariaDB Server applications / Database software |
Vendor | MariaDB Foundation |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU33806
Risk: Medium
CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2016-5440
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.
Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR.
MitigationInstall update from vendor's website.
Vulnerable software versionsMariaDB: 5.5.20 - 10.1.32
CPE2.3http://lists.opensuse.org/opensuse-updates/2016-09/msg00042.html
http://rhn.redhat.com/errata/RHSA-2016-1480.html
http://rhn.redhat.com/errata/RHSA-2016-1601.html
http://rhn.redhat.com/errata/RHSA-2016-1602.html
http://rhn.redhat.com/errata/RHSA-2016-1603.html
http://rhn.redhat.com/errata/RHSA-2016-1604.html
http://rhn.redhat.com/errata/RHSA-2016-1637.html
http://www.debian.org/security/2016/dsa-3624
http://www.debian.org/security/2016/dsa-3632
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.securityfocus.com/bid/91787
http://www.securityfocus.com/bid/91953
http://www.securitytracker.com/id/1036362
http://www.ubuntu.com/usn/USN-3040-1
http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168
http://mariadb.com/kb/en/mariadb/mariadb-10026-release-notes/
http://mariadb.com/kb/en/mariadb/mariadb-10115-release-notes/
http://mariadb.com/kb/en/mariadb/mariadb-5550-release-notes/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.