Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting generallogfile to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
[
{
"signature_type": "Line",
"source": "https://github.com/mariadb/server/commit/a02642b66e06f95b80fa9ee592ba50eb61dc2f17",
"digest": {
"threshold": 0.9,
"line_hashes": [
"284474919473169016970406210133607862503",
"56620395527721358171084621192052395955",
"155751907007791503660291135721680547973",
"284464292980216230235061452928340542994"
]
},
"target": {
"file": "sql/item_sum.cc"
},
"id": "CVE-2016-6662-16d79c87",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://github.com/mariadb/server/commit/a02642b66e06f95b80fa9ee592ba50eb61dc2f17",
"digest": {
"function_hash": "260358408969056573440033318428069010350",
"length": 1113.0
},
"target": {
"file": "sql/item_sum.cc",
"function": "Item_sum::register_sum_func"
},
"id": "CVE-2016-6662-4f786aaf",
"deprecated": false,
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-6662.json"