Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2016-3452: Oracle MySQL and MariaDB Data Encryption Flaw Allows Confidential Information Exposure
CVE-2016-3452 · published 10 years ago
Summary
If you use Oracle MySQL or MariaDB, a flaw in the encryption feature can allow attackers to access sensitive information. This means that confidential data could be compromised if an attacker knows how to exploit this issue. Update your software to the latest version to fix this problem.
What to do
- Update alpine mariadb to version 5.5.51-r0.
- Update alpine mariadb to version 10.1.17-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Alpine:v3.2 | alpine | mariadb |
>= 5.5.20, < 5.5.51-r0 Fix: upgrade to 5.5.51-r0
|
| Alpine:v3.3 | alpine | mariadb |
>= 5.5.20, < 10.1.17-r0 Fix: upgrade to 10.1.17-r0
|
| – | redhat | enterprise_linux |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
| – | oracle | mysql |
>= 5.5.0, <= 5.5.48 >= 5.6.0, <= 5.6.29 >= 5.7.0, <= 5.7.10 cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* |
| – | mariadb | mariadb |
>= 5.5.20, < 5.5.49 >= 10.0.0, < 10.0.25 >= 10.1.0, < 10.1.14 cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* |
| – | ibm | powerkvm |
2.1 3.1 cpe:2.3:a:ibm:powerkvm:2.1:*:*:*:*:*:*:* |
| – | oracle | linux |
7 cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:* |
Original advisory text
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote at...
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption.
References
- https://security.alpinelinux.org/vuln/CVE-2016-3452 Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0705.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1480.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1481.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1602.html Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Patch Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.h... Vendor Advisory
- http://www.securityfocus.com/bid/91787 Third Party Advisory VDB Entry
- http://www.securityfocus.com/bid/91999 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1036362 Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2016:1132 Third Party Advisory
- https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/ Vendor Advisory
- https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/ Vendor Advisory
- https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/ Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Timeline
Published21 Jul 2016
Updated25 Oct 2026
First seen15 Mar 2026
Track software like this
Free during beta