Sign-up

ID

VAR-201507-0303


CVE

CVE-2015-2620


TITLE

Oracle MySQL of MySQL Server In Server : Security : Privileges Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-003712

DESCRIPTION

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges. The vulnerability can be exploited over the 'MySQL Protocol' protocol. The 'Server : Security : Privileges' sub component is affected. This vulnerability affects the following supported versions: 5.5.43 and earlier, 5.6.23 and earlier. The database system has the characteristics of high performance, low cost and good reliability. Remote attackers can use this vulnerability to read data, affecting data confidentiality. 5 client) - i386, x86_64 3. ============================================================================ Ubuntu Security Notice USN-2674-1 July 21, 2015 mysql-5.5, mysql-5.6 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.04 - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in MySQL. MySQL has been updated to 5.5.44 in Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 14.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-44.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-25.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.04: mysql-server-5.6 5.6.25-0ubuntu0.15.04.1 Ubuntu 14.10: mysql-server-5.5 5.5.44-0ubuntu0.14.10.1 Ubuntu 14.04 LTS: mysql-server-5.5 5.5.44-0ubuntu0.14.04.1 Ubuntu 12.04 LTS: mysql-server-5.5 5.5.44-0ubuntu0.12.04.1 In general, a standard system update will make all the necessary changes. For the stable distribution (jessie), these problems have been fixed in version 5.5.44-0+deb8u1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: mariadb security update Advisory ID: RHSA-2015:1665-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1665.html Issue date: 2015-08-24 CVE Names: CVE-2015-0433 CVE-2015-0441 CVE-2015-0499 CVE-2015-0501 CVE-2015-0505 CVE-2015-2568 CVE-2015-2571 CVE-2015-2573 CVE-2015-2582 CVE-2015-2620 CVE-2015-2643 CVE-2015-2648 CVE-2015-3152 CVE-2015-4737 CVE-2015-4752 CVE-2015-4757 ===================================================================== 1. Summary: Updated mariadb packages that fix several security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the "--ssl" option. A man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server. (CVE-2015-3152) This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2015-0501, CVE-2015-2568, CVE-2015-0499, CVE-2015-2571, CVE-2015-0433, CVE-2015-0441, CVE-2015-0505, CVE-2015-2573, CVE-2015-2582, CVE-2015-2620, CVE-2015-2643, CVE-2015-2648, CVE-2015-4737, CVE-2015-4752, CVE-2015-4757) These updated packages upgrade MariaDB to version 5.5.44. Refer to the MariaDB Release Notes listed in the References section for a complete list of changes. All MariaDB users should upgrade to these updated packages, which correct these issues. After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1212758 - CVE-2015-0501 mysql: unspecified vulnerability related to Server:Compiling (CPU April 2015) 1212763 - CVE-2015-2568 mysql: unspecified vulnerability related to Server:Security:Privileges (CPU April 2015) 1212768 - CVE-2015-0499 mysql: unspecified vulnerability related to Server:Federated (CPU April 2015) 1212772 - CVE-2015-2571 mysql: unspecified vulnerability related to Server:Optimizer (CPU April 2015) 1212776 - CVE-2015-0433 mysql: unspecified vulnerability related to Server:InnoDB:DML (CPU April 2015) 1212777 - CVE-2015-0441 mysql: unspecified vulnerability related to Server:Security:Encryption (CPU April 2015) 1212780 - CVE-2015-0505 mysql: unspecified vulnerability related to Server:DDL (CPU April 2015) 1212783 - CVE-2015-2573 mysql: unspecified vulnerability related to Server:DDL (CPU April 2015) 1217506 - CVE-2015-3152 mysql: use of SSL/TLS can not be enforced in mysql client library (oCERT-2015-003, BACKRONYM) 1244768 - CVE-2015-2582 mysql: unspecified vulnerability related to Server:GIS (CPU July 2015) 1244771 - CVE-2015-2620 mysql: unspecified vulnerability related to Server:Security:Privileges (CPU July 2015) 1244774 - CVE-2015-2643 mysql: unspecified vulnerability related to Server:Optimizer (CPU July 2015) 1244775 - CVE-2015-2648 mysql: unspecified vulnerability related to Server:DML (CPU July 2015) 1244778 - CVE-2015-4737 mysql: unspecified vulnerability related to Server:Pluggable Auth (CPU July 2015) 1244779 - CVE-2015-4752 mysql: unspecified vulnerability related to Server:I_S (CPU July 2015) 1244781 - CVE-2015-4757 mysql: unspecified vulnerability related to Server:Optimizer (CPU July 2015) 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: mariadb-5.5.44-1.el7_1.src.rpm x86_64: mariadb-5.5.44-1.el7_1.x86_64.rpm mariadb-debuginfo-5.5.44-1.el7_1.i686.rpm mariadb-debuginfo-5.5.44-1.el7_1.x86_64.rpm mariadb-libs-5.5.44-1.el7_1.i686.rpm mariadb-libs-5.5.44-1.el7_1.x86_64.rpm mariadb-server-5.5.44-1.el7_1.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: mariadb-bench-5.5.44-1.el7_1.x86_64.rpm mariadb-debuginfo-5.5.44-1.el7_1.i686.rpm mariadb-debuginfo-5.5.44-1.el7_1.x86_64.rpm mariadb-devel-5.5.44-1.el7_1.i686.rpm mariadb-devel-5.5.44-1.el7_1.x86_64.rpm mariadb-embedded-5.5.44-1.el7_1.i686.rpm mariadb-embedded-5.5.44-1.el7_1.x86_64.rpm mariadb-embedded-devel-5.5.44-1.el7_1.i686.rpm mariadb-embedded-devel-5.5.44-1.el7_1.x86_64.rpm mariadb-test-5.5.44-1.el7_1.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: mariadb-5.5.44-1.el7_1.src.rpm x86_64: mariadb-5.5.44-1.el7_1.x86_64.rpm mariadb-debuginfo-5.5.44-1.el7_1.i686.rpm mariadb-debuginfo-5.5.44-1.el7_1.x86_64.rpm mariadb-libs-5.5.44-1.el7_1.i686.rpm mariadb-libs-5.5.44-1.el7_1.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: mariadb-bench-5.5.44-1.el7_1.x86_64.rpm mariadb-debuginfo-5.5.44-1.el7_1.i686.rpm mariadb-debuginfo-5.5.44-1.el7_1.x86_64.rpm mariadb-devel-5.5.44-1.el7_1.i686.rpm mariadb-devel-5.5.44-1.el7_1.x86_64.rpm mariadb-embedded-5.5.44-1.el7_1.i686.rpm mariadb-embedded-5.5.44-1.el7_1.x86_64.rpm mariadb-embedded-devel-5.5.44-1.el7_1.i686.rpm mariadb-embedded-devel-5.5.44-1.el7_1.x86_64.rpm mariadb-server-5.5.44-1.el7_1.x86_64.rpm mariadb-test-5.5.44-1.el7_1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: mariadb-5.5.44-1.el7_1.src.rpm ppc64: mariadb-5.5.44-1.el7_1.ppc64.rpm mariadb-bench-5.5.44-1.el7_1.ppc64.rpm mariadb-debuginfo-5.5.44-1.el7_1.ppc.rpm mariadb-debuginfo-5.5.44-1.el7_1.ppc64.rpm mariadb-devel-5.5.44-1.el7_1.ppc.rpm mariadb-devel-5.5.44-1.el7_1.ppc64.rpm mariadb-libs-5.5.44-1.el7_1.ppc.rpm mariadb-libs-5.5.44-1.el7_1.ppc64.rpm mariadb-server-5.5.44-1.el7_1.ppc64.rpm mariadb-test-5.5.44-1.el7_1.ppc64.rpm s390x: mariadb-5.5.44-1.el7_1.s390x.rpm mariadb-bench-5.5.44-1.el7_1.s390x.rpm mariadb-debuginfo-5.5.44-1.el7_1.s390.rpm mariadb-debuginfo-5.5.44-1.el7_1.s390x.rpm mariadb-devel-5.5.44-1.el7_1.s390.rpm mariadb-devel-5.5.44-1.el7_1.s390x.rpm mariadb-libs-5.5.44-1.el7_1.s390.rpm mariadb-libs-5.5.44-1.el7_1.s390x.rpm mariadb-server-5.5.44-1.el7_1.s390x.rpm mariadb-test-5.5.44-1.el7_1.s390x.rpm x86_64: mariadb-5.5.44-1.el7_1.x86_64.rpm mariadb-bench-5.5.44-1.el7_1.x86_64.rpm mariadb-debuginfo-5.5.44-1.el7_1.i686.rpm mariadb-debuginfo-5.5.44-1.el7_1.x86_64.rpm mariadb-devel-5.5.44-1.el7_1.i686.rpm mariadb-devel-5.5.44-1.el7_1.x86_64.rpm mariadb-libs-5.5.44-1.el7_1.i686.rpm mariadb-libs-5.5.44-1.el7_1.x86_64.rpm mariadb-server-5.5.44-1.el7_1.x86_64.rpm mariadb-test-5.5.44-1.el7_1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: mariadb-5.5.44-1.ael7b_1.src.rpm ppc64le: mariadb-5.5.44-1.ael7b_1.ppc64le.rpm mariadb-bench-5.5.44-1.ael7b_1.ppc64le.rpm mariadb-debuginfo-5.5.44-1.ael7b_1.ppc64le.rpm mariadb-devel-5.5.44-1.ael7b_1.ppc64le.rpm mariadb-libs-5.5.44-1.ael7b_1.ppc64le.rpm mariadb-server-5.5.44-1.ael7b_1.ppc64le.rpm mariadb-test-5.5.44-1.ael7b_1.ppc64le.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: mariadb-debuginfo-5.5.44-1.el7_1.ppc.rpm mariadb-debuginfo-5.5.44-1.el7_1.ppc64.rpm mariadb-embedded-5.5.44-1.el7_1.ppc.rpm mariadb-embedded-5.5.44-1.el7_1.ppc64.rpm mariadb-embedded-devel-5.5.44-1.el7_1.ppc.rpm mariadb-embedded-devel-5.5.44-1.el7_1.ppc64.rpm s390x: mariadb-debuginfo-5.5.44-1.el7_1.s390.rpm mariadb-debuginfo-5.5.44-1.el7_1.s390x.rpm mariadb-embedded-5.5.44-1.el7_1.s390.rpm mariadb-embedded-5.5.44-1.el7_1.s390x.rpm mariadb-embedded-devel-5.5.44-1.el7_1.s390.rpm mariadb-embedded-devel-5.5.44-1.el7_1.s390x.rpm x86_64: mariadb-debuginfo-5.5.44-1.el7_1.i686.rpm mariadb-debuginfo-5.5.44-1.el7_1.x86_64.rpm mariadb-embedded-5.5.44-1.el7_1.i686.rpm mariadb-embedded-5.5.44-1.el7_1.x86_64.rpm mariadb-embedded-devel-5.5.44-1.el7_1.i686.rpm mariadb-embedded-devel-5.5.44-1.el7_1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64le: mariadb-debuginfo-5.5.44-1.ael7b_1.ppc64le.rpm mariadb-embedded-5.5.44-1.ael7b_1.ppc64le.rpm mariadb-embedded-devel-5.5.44-1.ael7b_1.ppc64le.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: mariadb-5.5.44-1.el7_1.src.rpm x86_64: mariadb-5.5.44-1.el7_1.x86_64.rpm mariadb-bench-5.5.44-1.el7_1.x86_64.rpm mariadb-debuginfo-5.5.44-1.el7_1.i686.rpm mariadb-debuginfo-5.5.44-1.el7_1.x86_64.rpm mariadb-devel-5.5.44-1.el7_1.i686.rpm mariadb-devel-5.5.44-1.el7_1.x86_64.rpm mariadb-libs-5.5.44-1.el7_1.i686.rpm mariadb-libs-5.5.44-1.el7_1.x86_64.rpm mariadb-server-5.5.44-1.el7_1.x86_64.rpm mariadb-test-5.5.44-1.el7_1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: mariadb-debuginfo-5.5.44-1.el7_1.i686.rpm mariadb-debuginfo-5.5.44-1.el7_1.x86_64.rpm mariadb-embedded-5.5.44-1.el7_1.i686.rpm mariadb-embedded-5.5.44-1.el7_1.x86_64.rpm mariadb-embedded-devel-5.5.44-1.el7_1.i686.rpm mariadb-embedded-devel-5.5.44-1.el7_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-0433 https://access.redhat.com/security/cve/CVE-2015-0441 https://access.redhat.com/security/cve/CVE-2015-0499 https://access.redhat.com/security/cve/CVE-2015-0501 https://access.redhat.com/security/cve/CVE-2015-0505 https://access.redhat.com/security/cve/CVE-2015-2568 https://access.redhat.com/security/cve/CVE-2015-2571 https://access.redhat.com/security/cve/CVE-2015-2573 https://access.redhat.com/security/cve/CVE-2015-2582 https://access.redhat.com/security/cve/CVE-2015-2620 https://access.redhat.com/security/cve/CVE-2015-2643 https://access.redhat.com/security/cve/CVE-2015-2648 https://access.redhat.com/security/cve/CVE-2015-3152 https://access.redhat.com/security/cve/CVE-2015-4737 https://access.redhat.com/security/cve/CVE-2015-4752 https://access.redhat.com/security/cve/CVE-2015-4757 https://access.redhat.com/security/updates/classification/#moderate http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html#AppendixMSQL http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixMSQL https://mariadb.com/kb/en/mariadb/mariadb-5544-release-notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFV228TXlSAg2UNWIIRAm1mAJ0bzbWNcno0Sy/+xCRBh61u0Og5LQCfYvOB tzK/FpD+vNcUAhqnRuiFgiM= =BpLD -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 2.7

sources: NVD: CVE-2015-2620 // JVNDB: JVNDB-2015-003712 // BID: 75837 // VULHUB: VHN-80581 // VULMON: CVE-2015-2620 // PACKETSTORM: 133090 // PACKETSTORM: 132770 // PACKETSTORM: 133091 // PACKETSTORM: 132744 // PACKETSTORM: 133232 // PACKETSTORM: 133233 // PACKETSTORM: 133276

AFFECTED PRODUCTS

vendor:oraclemodel:mysqlscope:lteversion:5.5.43

Trust: 1.8

vendor:oraclemodel:mysqlscope:lteversion:5.6.23

Trust: 1.8

vendor:mariadbmodel:mariadbscope:gteversion:5.5.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:12.04

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:14.04

Trust: 1.0

vendor:junipermodel:junos spacescope:lteversion:15.1

Trust: 1.0

vendor:mariadbmodel:mariadbscope:gteversion:10.0.0

Trust: 1.0

vendor:oraclemodel:solarisscope:eqversion:11.3

Trust: 1.0

vendor:mariadbmodel:mariadbscope:ltversion:5.5.44

Trust: 1.0

vendor:oraclemodel:mysqlscope:gteversion:5.6.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:14.10

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:8.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:15.04

Trust: 1.0

vendor:oraclemodel:mysqlscope:gteversion:5.5.0

Trust: 1.0

vendor:mariadbmodel:mariadbscope:ltversion:10.0.20

Trust: 1.0

vendor:mysql abmodel:mysqlscope:lteversion:5.5.9

Trust: 0.8

vendor:oraclemodel:mysqlscope:eqversion:5.6.23

Trust: 0.6

vendor:oraclemodel:mysqlscope:eqversion:5.5.43

Trust: 0.6

vendor:ubuntumodel:linuxscope:eqversion:15.04

Trust: 0.3

vendor:ubuntumodel:linuxscope:eqversion:14.10

Trust: 0.3

vendor:ubuntumodel:linux ltsscope:eqversion:14.04

Trust: 0.3

vendor:ubuntumodel:linux lts i386scope:eqversion:12.04

Trust: 0.3

vendor:ubuntumodel:linux lts amd64scope:eqversion:12.04

Trust: 0.3

vendor:redhatmodel:software collections for rhelscope:eqversion:170

Trust: 0.3

vendor:redhatmodel:software collections for rhelscope:eqversion:160

Trust: 0.3

vendor:redhatmodel:enterprise linux workstationscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc nodescope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop workstation clientscope:eqversion:5

Trust: 0.3

vendor:redhatmodel:enterprise linux desktopscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop clientscope:eqversion:5

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:5

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.23

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.22

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.21

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.5.42

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.5.41

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.5.40

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.16

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.15

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.5.43

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.5.36

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.5.35

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:7

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:6.0

Trust: 0.3

vendor:centosmodel:centosscope:eqversion:7

Trust: 0.3

vendor:centosmodel:centosscope:eqversion:5

Trust: 0.3

sources: BID: 75837 // JVNDB: JVNDB-2015-003712 // CNNVD: CNNVD-201507-518 // NVD: CVE-2015-2620

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-2620
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-2620
value: LOW

Trust: 0.8

CNNVD: CNNVD-201507-518
value: LOW

Trust: 0.6

VULHUB: VHN-80581
value: MEDIUM

Trust: 0.1

VULMON: CVE-2015-2620
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-2620
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: CVE-2015-2620
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-80581
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-80581 // VULMON: CVE-2015-2620 // JVNDB: JVNDB-2015-003712 // CNNVD: CNNVD-201507-518 // NVD: CVE-2015-2620

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2015-2620

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201507-518

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201507-518

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-003712

PATCH
title:Oracle Critical Patch Update Advisory - July 2015url:http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
Trust: 0.8
title:Text Form of Oracle Critical Patch Update - July 2015 Risk Matricesurl:http://www.oracle.com/technetwork/topics/security/cpujul2015verbose-2367947.html
Trust: 0.8
title:RHSA-2015:1630url:https://rhn.redhat.com/errata/RHSA-2015-1630.html
Trust: 0.8
title:July 2015 Critical Patch Update Releasedurl:https://blogs.oracle.com/security/entry/july_2015_critical_patch_update
Trust: 0.8
title:JSA10698url:http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
Trust: 0.8
title:Oracle MySQL Server Server:Security:Privileges Subcomponent security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=89460
Trust: 0.6
title:Red Hat: CVE-2015-2620url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2015-2620
Trust: 0.1
title:Debian CVElist Bug Report Logs: mysql-5.5: Multiple security fixes from the July 2015 CPUurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=80ce8a549a7222b391a7db7e578bd59a
Trust: 0.1
title:Ubuntu Security Notice: mysql-5.5, mysql-5.6 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-2674-1
Trust: 0.1
title:Oracle: Oracle Critical Patch Update Advisory - July 2015url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=459961024c4bdce7bb3a1a40a65a6f2e
Trust: 0.1
title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - April 2016url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=976a4da35d55283870dbb31b88a6c655
Trust: 0.1
title: - url:https://github.com/Live-Hack-CVE/CVE-2015-2620 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2015-2620 // 
            
            
            
            JVNDB: JVNDB-2015-003712 // 
            
            
            
            CNNVD: CNNVD-201507-518

EXTERNAL IDS
db:NVDid:CVE-2015-2620
Trust: 3.6
db:BIDid:75837
Trust: 2.1
db:SECTRACKid:1032911
Trust: 1.8
db:JUNIPERid:JSA10698
Trust: 1.8
db:JVNDBid:JVNDB-2015-003712
Trust: 0.8
db:CNNVDid:CNNVD-201507-518
Trust: 0.7
db:VULHUBid:VHN-80581
Trust: 0.1
db:VULMONid:CVE-2015-2620
Trust: 0.1
db:PACKETSTORMid:133090
Trust: 0.1
db:PACKETSTORMid:132770
Trust: 0.1
db:PACKETSTORMid:133091
Trust: 0.1
db:PACKETSTORMid:132744
Trust: 0.1
db:PACKETSTORMid:133232
Trust: 0.1
db:PACKETSTORMid:133233
Trust: 0.1
db:PACKETSTORMid:133276
Trust: 0.1
sources:
            
            
            VULHUB: VHN-80581 // 
            
            
            
            VULMON: CVE-2015-2620 // 
            
            
            
            BID: 75837 // 
            
            
            
            JVNDB: JVNDB-2015-003712 // 
            
            
            
            PACKETSTORM: 133090 // 
            
            
            
            PACKETSTORM: 132770 // 
            
            
            
            PACKETSTORM: 133091 // 
            
            
            
            PACKETSTORM: 132744 // 
            
            
            
            PACKETSTORM: 133232 // 
            
            
            
            PACKETSTORM: 133233 // 
            
            
            
            PACKETSTORM: 133276 // 
            
            
            
            CNNVD: CNNVD-201507-518 // 
            
            
            
            NVD: CVE-2015-2620

REFERENCES
url:http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
Trust: 2.3
url:http://rhn.redhat.com/errata/rhsa-2015-1646.html
Trust: 2.2
url:http://rhn.redhat.com/errata/rhsa-2015-1647.html
Trust: 2.2
url:http://rhn.redhat.com/errata/rhsa-2015-1665.html
Trust: 2.2
url:http://rhn.redhat.com/errata/rhsa-2015-1628.html
Trust: 1.9
url:http://rhn.redhat.com/errata/rhsa-2015-1629.html
Trust: 1.9
url:http://www.ubuntu.com/usn/usn-2674-1
Trust: 1.9
url:http://www.securityfocus.com/bid/75837
Trust: 1.8
url:http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Trust: 1.8
url:http://www.debian.org/security/2015/dsa-3308
Trust: 1.8
url:https://security.gentoo.org/glsa/201610-06
Trust: 1.8
url:http://rhn.redhat.com/errata/rhsa-2015-1630.html
Trust: 1.8
url:http://www.securitytracker.com/id/1032911
Trust: 1.8
url:http://lists.opensuse.org/opensuse-updates/2015-09/msg00042.html
Trust: 1.8
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10698
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2620
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2620
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2015-4737
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2015-2643
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2015-2620
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2015-2582
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2015-2648
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2015-4752
Trust: 0.7
url:https://access.redhat.com/security/cve/cve-2015-2620
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2015-4757
Trust: 0.6
url:https://access.redhat.com/security/cve/cve-2015-4752
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2015-4757
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2015-2648
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2015-2643
Trust: 0.5
url:http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#appendixmsql
Trust: 0.5
url:https://access.redhat.com/articles/11258
Trust: 0.5
url:https://access.redhat.com/security/team/contact/
Trust: 0.5
url:https://www.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2015-4737
Trust: 0.5
url:https://bugzilla.redhat.com/):
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2015-2582
Trust: 0.5
url:https://access.redhat.com/security/team/key/
Trust: 0.5
url:https://nvd.nist.gov/vuln/detail/cve-2015-2571
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2015-2568
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2015-0501
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2015-0441
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2015-2573
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2015-0433
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2015-0501
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2015-0433
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2015-0499
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2015-0505
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2015-0441
Trust: 0.4
url:https://access.redhat.com/security/updates/classification/#moderate
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2015-2573
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2015-2568
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2015-0499
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2015-0505
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2015-2571
Trust: 0.4
url:http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html#appendixmsql
Trust: 0.4
url:http://www.oracle.com/index.html
Trust: 0.3
url:https://access.redhat.com/security/cve/cve-2015-3152
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2015-3152
Trust: 0.3
url:https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-45.html
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-4771
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-2661
Trust: 0.2
url:http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-44.html
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-4769
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-4761
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-2641
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-4772
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-2639
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-2611
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-4767
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-2617
Trust: 0.2
url:https://mariadb.com/kb/en/mariadb/mariadb-5544-release-notes/
Trust: 0.2
url:http://kb.juniper.net/infocenter/index?page=content&amp;id=jsa10698
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://github.com/live-hack-cve/cve-2015-2620
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=39985
Trust: 0.1
url:https://usn.ubuntu.com/2674-1/
Trust: 0.1
url:http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#appendixmsql
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2014-6568
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-0432
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-0411
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-0382
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-0381
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-0391
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-0391
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-0432
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-0411
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-0374
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-6568
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-0374
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-0382
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-0381
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.44-0ubuntu0.14.04.1
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.44-0ubuntu0.12.04.1
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.44-0ubuntu0.14.10.1
Trust: 0.1
url:http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-25.html
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/mysql-5.6/5.6.25-0ubuntu0.15.04.1
Trust: 0.1
url:https://www.debian.org/security/faq
Trust: 0.1
url:https://www.debian.org/security/
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4772
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-2617
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-2641
Trust: 0.1
url:https://access.redhat.com/security/updates/classification/#important
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-2611
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-2661
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4769
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4767
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4771
Trust: 0.1
url:https://mariadb.com/kb/en/mariadb/mariadb-10020-release-notes/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4756
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-2639
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4761
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4756
Trust: 0.1
sources:
            
            
            VULHUB: VHN-80581 // 
            
            
            
            VULMON: CVE-2015-2620 // 
            
            
            
            BID: 75837 // 
            
            
            
            JVNDB: JVNDB-2015-003712 // 
            
            
            
            PACKETSTORM: 133090 // 
            
            
            
            PACKETSTORM: 132770 // 
            
            
            
            PACKETSTORM: 133091 // 
            
            
            
            PACKETSTORM: 132744 // 
            
            
            
            PACKETSTORM: 133232 // 
            
            
            
            PACKETSTORM: 133233 // 
            
            
            
            PACKETSTORM: 133276 // 
            
            
            
            CNNVD: CNNVD-201507-518 // 
            
            
            
            NVD: CVE-2015-2620

CREDITS
Red Hat
Trust: 0.5
sources:
            
            
            PACKETSTORM: 133090 // 
            
            
            
            PACKETSTORM: 133091 // 
            
            
            
            PACKETSTORM: 133232 // 
            
            
            
            PACKETSTORM: 133233 // 
            
            
            
            PACKETSTORM: 133276

SOURCES
db:VULHUBid:VHN-80581
db:VULMONid:CVE-2015-2620
db:BIDid:75837
db:JVNDBid:JVNDB-2015-003712
db:PACKETSTORMid:133090
db:PACKETSTORMid:132770
db:PACKETSTORMid:133091
db:PACKETSTORMid:132744
db:PACKETSTORMid:133232
db:PACKETSTORMid:133233
db:PACKETSTORMid:133276
db:CNNVDid:CNNVD-201507-518
db:NVDid:CVE-2015-2620

LAST UPDATE DATE
2024-12-23T22:05:47.084000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-80581date:2019-02-05T00:00:00
db:VULMONid:CVE-2015-2620date:2022-08-29T00:00:00
db:BIDid:75837date:2016-10-26T01:16:00
db:JVNDBid:JVNDB-2015-003712date:2015-10-21T00:00:00
db:CNNVDid:CNNVD-201507-518date:2022-08-30T00:00:00
db:NVDid:CVE-2015-2620date:2024-11-21T02:27:43.397

SOURCES RELEASE DATE
db:VULHUBid:VHN-80581date:2015-07-16T00:00:00
db:VULMONid:CVE-2015-2620date:2015-07-16T00:00:00
db:BIDid:75837date:2015-07-14T00:00:00
db:JVNDBid:JVNDB-2015-003712date:2015-07-21T00:00:00
db:PACKETSTORMid:133090date:2015-08-17T15:38:25
db:PACKETSTORMid:132770date:2015-07-21T23:42:40
db:PACKETSTORMid:133091date:2015-08-17T15:38:38
db:PACKETSTORMid:132744date:2015-07-20T15:45:44
db:PACKETSTORMid:133232date:2015-08-21T16:58:17
db:PACKETSTORMid:133233date:2015-08-21T16:58:26
db:PACKETSTORMid:133276date:2015-08-24T22:05:44
db:CNNVDid:CNNVD-201507-518date:2015-07-17T00:00:00
db:NVDid:CVE-2015-2620date:2015-07-16T10:59:43.653