MySQL Hit By "Critical" Remote Code Execution 0-Day
Written by Michael Larabel in Free Software on 12 September 2016 at 04:04 PM EDT. 25 Comments
FREE SOFTWARE --
The latest high-profile open-source software project having a bad security day is MySQL... MySQL 5.5/5.6/5.7 has a nasty zero-day vulnerability.

Researchers have discovered multiple "severe" MySQL vulnerabilities with the CVE-2016-6662 being marked as critical and does affect the latest MySQL version.

This 0-day is open for both local and remote attackers and could come via authenticated access to a MySQL database (including web UI administration panels) or via SQL injection attacks. The exploit could allow attackers to execute arbitrary code with root privileges.

More details on this CVE via this mailing list post while exhaustive details are available via the report at LegalHackers.com.

Oracle has yet to release a fixed version of MySQL -- even though it was reported to them in July -- while MariaDB and others have acted.
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related Free Software News
Popular News This Week