Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting generallogfile to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
[
{
"deprecated": false,
"source": "https://github.com/mariadb/server/commit/a02642b66e06f95b80fa9ee592ba50eb61dc2f17",
"id": "CVE-2016-6662-16d79c87",
"target": {
"file": "sql/item_sum.cc"
},
"digest": {
"line_hashes": [
"284474919473169016970406210133607862503",
"56620395527721358171084621192052395955",
"155751907007791503660291135721680547973",
"284464292980216230235061452928340542994"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/mariadb/server/commit/a02642b66e06f95b80fa9ee592ba50eb61dc2f17",
"id": "CVE-2016-6662-4f786aaf",
"target": {
"file": "sql/item_sum.cc",
"function": "Item_sum::register_sum_func"
},
"digest": {
"function_hash": "260358408969056573440033318428069010350",
"length": 1113.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/mariadb/server/commit/d40d3f4e57f375897aa29e72e947e372e6bc229d",
"id": "CVE-2016-6662-7bbe1854",
"target": {
"file": "sql/threadpool_common.cc",
"function": "threadpool_add_connection"
},
"digest": {
"function_hash": "265266561670776493520252576851886354376",
"length": 817.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/mariadb/server/commit/d40d3f4e57f375897aa29e72e947e372e6bc229d",
"id": "CVE-2016-6662-9e08ba3b",
"target": {
"file": "sql/threadpool_common.cc"
},
"digest": {
"line_hashes": [
"10062621672102205495104964677428442738",
"123313975116151584463582093265507537241",
"53996278754540829965589299461644774062",
"277133739334441058345156435673339337095",
"37383609000494826278362955741068784096",
"53157484199371218863321707227025411323"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6662.json"