VIR Vulnerability Intelligence Relay

CVE-2016-6662

critical
Published 2016-09-20 · Modified 2026-05-06
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
10.0
VIR risk
9.8

Description

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2016-6662.html

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://mariadb.com/kb/en/mariadb/mariadb-5551-release-notes/

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://mariadb.com/kb/en/mariadb/mariadb-10117-release-notes/

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://mariadb.com/kb/en/mariadb/mariadb-10027-release-notes/

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://jira.mariadb.org/browse/MDEV-10465

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

OS impact
OSVersionStatusFixed in
suse slesaffected
debian debian8.0affected
redhat rhel7.0affected
redhat rhel6.0affected

Application impact
VendorProductVersionsFixed
oracle oraclemysql{"startIncluding":"5.5.0","endIncluding":"5.5.52"}
perconapercona_server{"startIncluding":"5.5","endExcluding":"5.5.51-38.1"}5.5.51-38.1
mysql mariadbmariadb{"startIncluding":"5.5.20","endExcluding":"5.5.51"}5.5.51
redhat redhatopenstack5.0
redhat redhatopenstack6.0
redhat redhatopenstack7.0
redhat redhatopenstack8
redhat redhatopenstack9
oracle oraclemysql{"startIncluding":"5.6.0","endIncluding":"5.6.33"}
oracle oraclemysql{"startIncluding":"5.7.0","endIncluding":"5.7.15"}
mysql mariadbmariadb{"startIncluding":"10.0.0","endExcluding":"10.0.27"}10.0.27
mysql mariadbmariadb{"startIncluding":"10.1.0","endExcluding":"10.1.17"}10.1.17

References

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.