Use-after-free error in MySQL Server - CVE-2017-3302

Vulnerability identifier: #VU6895

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3302

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to use-after-free error in the libmysqlclient.so. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

MySQL Server

mysql-5.5 (Debian package)
mariadb (Alpine package)
SUSE Linux
Ubuntu
Slackware Linux
Opensuse

Update to version 5.6.21, 5.5.55.

- update to
mysql-5.5 (Debian package) - addressed in versions 5.5.55-0+deb7u1, 5.5.55-0+deb8u1
mariadb (Alpine package) - update to 10.1.22-r0

• http://www.openwall.com/lists/oss-security/2017/02/11/11
• https://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

• openSUSE update for mariadb
• Slackware Linux update for mariadb
• SUSE Linux update for mariadb
• SUSE Linux update for mariadb
• Ubuntu update for MySQL
• Debian update for mysql-5.5
• Ubuntu update for MySQL
• Use-after-free error in mariadb (Alpine package)