CVE-2017-10268

Name	CVE-2017-10268
Description	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-1141-1, DLA-1407-1, DSA-4002-1, DSA-4341-1
NVD severity	low (attack range: local)
Debian Bugs	878398, 878402, 884065

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mariadb-10.0 (PTS)	jessie	10.0.32-0+deb8u1	vulnerable
	jessie (security)	10.0.37-0+deb8u1	fixed
mariadb-10.1 (PTS)	stretch	10.1.26-0+deb9u1	vulnerable
	stretch (security)	10.1.37-0+deb9u1	fixed
	buster	1:10.1.37-1	fixed
	sid	1:10.1.37-3	fixed
mysql-5.5 (PTS)	jessie	5.5.60-0+deb8u1	fixed
	jessie (security)	5.5.62-0+deb8u1	fixed
mysql-5.7 (PTS)	sid	5.7.24-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mariadb-10.0	source	(unstable)	(unfixed)	low
mariadb-10.0	source	jessie	10.0.35-0+deb8u1	low	DLA-1407-1
mariadb-10.1	source	(unstable)	10.1.29-1	low
mariadb-10.1	source	stretch	10.1.37-0+deb9u1	low	DSA-4341-1
mariadb-10.2	source	(unstable)	(unfixed)	low		884065
mysql-5.5	source	(unstable)	(unfixed)	low		878402
mysql-5.5	source	jessie	5.5.58-0+deb8u1	low	DSA-4002-1
mysql-5.5	source	wheezy	5.5.58-0+deb7u1	low	DLA-1141-1
mysql-5.7	source	(unstable)	5.7.20-1	low		878398

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL