CVE-2017-10268

Name	CVE-2017-10268
Description	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-1141-1, DLA-1407-1, DSA-4002-1, DSA-4341-1
NVD severity	low
Debian Bugs	878398, 878402, 884065

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mariadb-10.1 (PTS)	stretch	10.1.44-0+deb9u1	fixed
	stretch (security)	10.1.37-0+deb9u1	fixed
mysql-5.7 (PTS)	sid	5.7.26-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
mariadb-10.0	source	(unstable)	(unfixed)
mariadb-10.0	source	jessie	10.0.35-0+deb8u1	DLA-1407-1
mariadb-10.1	source	(unstable)	10.1.29-1
mariadb-10.1	source	stretch	10.1.37-0+deb9u1	DSA-4341-1
mariadb-10.2	source	(unstable)	(unfixed)		884065
mysql-5.5	source	(unstable)	(unfixed)		878402
mysql-5.5	source	jessie	5.5.58-0+deb8u1	DSA-4002-1
mysql-5.5	source	wheezy	5.5.58-0+deb7u1	DLA-1141-1
mysql-5.7	source	(unstable)	5.7.20-1		878398

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL