Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2016-6662

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

CVSS 9.8 · CriticalBuzz score 31.5

Buzz score

Why this CVE is surfacing

Buzz score total 31.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 9.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
22.0
8 evidence mentions in the snapshot
Diversity score
9.5
4 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
8 source links · newest first
  • Critical Privilege Escalation Flaws Found in MySQLSecurityWeek

    Database management systems MySQL, MariaDB and PerconaDB are affected by a couple of serious privilege escalation vulnerabilities. The developers of the vulnerable software have released updates to address the flaws.

    newswww.securityweek.comNov 7, 2016, 12:24 PM
  • Critical MySQL flaws can allow attackers to hack into your serverSecurity Affairs

    The security expert Dawid Golunski disclosed critical vulnerabilities in MySQL, MariaDB and PerconaDB can lead fully compromise of servers. Critical vulnerabilities affecting the MySQL, MariaDB and PerconaDB can lead fully compromise of servers. The flaws could be exploited by attackers to arbitrary code execution, root privilege escalation and, of course, server compromise. Dawid Golunski (@dawid_golunski) from Legal […]

    newssecurityaffairs.comNov 3, 2016, 8:16 AM
  • Week in review: MySQL 0-day, Stingrays, and the end of Patch TuesdayHelp Net Security

    Here’s an overview of some of last week’s most interesting news and articles: Five ways to respond to the ransomware threat While organizations wrestle with the ever-pressing issue of whether to pay or not to pay if they’re victimized, Logicalis US suggests CXOs focus first on how to protect, thwart and recover from a potential attack. MySQL 0-day could lead to total system compromise Researcher Dawid Golunski has discovered multiple severe vulnerabilities affecting the popular … More →

    newswww.helpnetsecurity.comSep 18, 2016, 1:00 PM
  • Security Affairs newsletter Round 78 – News of the weekSecurity Affairs

    A new round of the weekly SecurityAffairs newsletter arrived! The best news of the week with Security Affairs. First of all let me inform you that at the #infosec16 SecurityAffairs was awarded as The Best European Personal Security Blog http://securityaffairs.co/wordpress/48202/breaking-news/securityaffairs-best-european-personal-security-blog.html THANK YOU! LuaBot is the first Linux DDoS botnet written in Lua Language Security Affairs newsletter Round […]

    newssecurityaffairs.comSep 18, 2016, 11:00 AM
  • CVE-2016-6662 – Researcher disclosed a critical MySQL Zero-DaySecurity Affairs

    A security researcher disclosed a critical MySQL zero-day affecting all the default configuration of all MySQL versions including 5.5, 5.6 and 5.7. The security researcher Dawid Golunski has disclosed a critical zero-day vulnerability affecting the popular database management system (RDBMS) MySQL. The researcher decided to disclose the critical flaw because Oracle failed to release a […]

    newssecurityaffairs.comSep 13, 2016, 4:03 AM
  • MySQL 0-day could lead to total system compromiseHelp Net Security

    Researcher Dawid Golunski has discovered multiple severe vulnerabilities affecting the popular open source database MySQL and its forks (e.g. MariaDB, Percona). One of these – CVE-2016-6662 – can be exploited by attackers to inject malicious settings into MySQL configuration files or create new ones, allowing them to execute arbitrary code with root privileges when the MySQL service is restarted. This could lead to total compromise of the server running the vulnerable MySQL version. “The vulnerability … More →

    newswww.helpnetsecurity.comSep 12, 2016, 7:17 PM
  • MySQL zero-day exploit puts some servers at risk of hackingCSO Online

    A publicly disclosed vulnerability in the MySQL database could allow attackers to completely compromise some servers. The vulnerability affects “all MySQL servers in default configuration in all version branches (5.7, 5.6, and 5.5) including the latest versions,” as well as the MySQL-derived databases MariaDB and Percona DB, according to Dawid Golunski, the researcher who found […]

    newswww.csoonline.comSep 12, 2016, 7:05 PM
  • Critical MySQL Zero-Day Exposes Servers to AttacksSecurityWeek

    A security researcher has decided to disclose a critical zero-day vulnerability in the MySQL open-source database software after Oracle failed to release a patch in more than 40 days after being informed of its existence.

    newswww.securityweek.comSep 12, 2016, 4:48 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence