VIR Vulnerability Intelligence Relay

CVE-2016-6662

critical
Published 2016-09-20 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
10.0

Description

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-40360 local linux
Dawid Golunski · 2016-09-12

MySQL / MariaDB / PerconaDB 5.5.51/5.6.32/5.7.14 - Code Execution / Privilege Escalation

Source code queued for fetch — refresh in a moment.

OS impact
debian Debian Affected 1 release
VersionStatusFixed in
8.0 Affected —
redhat Red Hat Affected 2 releases
VersionStatusFixed in
7.0 Affected —
6.0 Affected —
suse SUSE Affected 1 release
VersionStatusFixed in
— Affected —

Application impact
VendorProductVersionsFixed
oracle oraclemysql{"startIncluding":"5.5.0","endIncluding":"5.5.52"}
perconapercona_server{"startIncluding":"5.5","endExcluding":"5.5.51-38.1"}5.5.51-38.1
mysql mariadbmariadb{"startIncluding":"5.5.20","endExcluding":"5.5.51"}5.5.51
redhat redhatopenstack5.0
redhat redhatopenstack6.0
redhat redhatopenstack7.0
redhat redhatopenstack8
redhat redhatopenstack9
oracle oraclemysql{"startIncluding":"5.6.0","endIncluding":"5.6.33"}
oracle oraclemysql{"startIncluding":"5.7.0","endIncluding":"5.7.15"}
mysql mariadbmariadb{"startIncluding":"10.0.0","endExcluding":"10.0.27"}10.0.27
mysql mariadbmariadb{"startIncluding":"10.1.0","endExcluding":"10.1.17"}10.1.17

References

CWEs

CWE-264

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.