{"id":"CVE-2016-6662","details":"Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.","modified":"2026-08-18T08:26:20.706222Z","published":"2016-09-20T18:59:00.127Z","related":["SUSE-RU-2023:3956-1","SUSE-RU-2023:4991-1","SUSE-SU-2016:2343-1","SUSE-SU-2016:2395-1","SUSE-SU-2016:2404-1","SUSE-SU-2016:2780-1","openSUSE-SU-2024:10200-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:percona:percona_server:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.6"},{"fixed":"5.6.32-78.0"}],"source":"CPE_RANGE","vendor_product":"percona:percona_server"},{"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_desktop"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0"},{"last_affected":"6.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server"},{"extracted_events":[{"introduced":"7.3"},{"last_affected":"7.3"},{"introduced":"7.4"},{"last_affected":"7.4"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_aus","cpes":["cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.3"},{"last_affected":"7.3"},{"introduced":"7.4"},{"last_affected":"7.4"},{"introduced":"7.5"},{"last_affected":"7.5"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_eus"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.3"},{"last_affected":"7.3"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_tus"},{"extracted_events":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_workstation","cpes":["cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.0"},{"last_affected":"5.0"},{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"7.0"},{"last_affected":"7.0"},{"introduced":"8"},{"last_affected":"8"},{"introduced":"9"},{"last_affected":"9"}],"source":"CPE_STRING","vendor_product":"redhat:openstack"}]},"references":[{"type":"ADVISORY","url":"http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2058.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2059.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2060.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2061.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2062.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2077.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2130.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2131.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2595.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2749.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2927.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2928.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0184.html"},{"type":"ADVISORY","url":"http://seclists.org/fulldisclosure/2016/Sep/23"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3666"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/09/12/3"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/92912"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1036769"},{"type":"ADVISORY","url":"https://mariadb.com/kb/en/mariadb/mariadb-10027-release-notes/"},{"type":"ADVISORY","url":"https://mariadb.com/kb/en/mariadb/mariadb-10117-release-notes/"},{"type":"ADVISORY","url":"https://mariadb.com/kb/en/mariadb/mariadb-5551-release-notes/"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201701-01"},{"type":"ADVISORY","url":"https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/"},{"type":"REPORT","url":"https://jira.mariadb.org/browse/MDEV-10465"},{"type":"FIX","url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/40360/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mariadb/server","events":[{"introduced":"5a6300dcc45da2d6c2b046560da0580548354b93"},{"fixed":"7d57772f47e0d69b2e2a7bcd62da59e54f8c8343"},{"introduced":"776555af021e917ce0d6235386b43ae59fdd5161"},{"fixed":"16702ec95f301d1a21eb5a6f5531387c9254b952"},{"introduced":"c235de12ae3723b96944337bd89ad9cc87f21d8f"},{"fixed":"a02642b66e06f95b80fa9ee592ba50eb61dc2f17"}],"database_specific":{"cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.5.20"},{"fixed":"5.5.51"},{"introduced":"10.0.0"},{"fixed":"10.0.27"},{"introduced":"10.1.0"},{"fixed":"10.1.17"}],"source":"CPE_RANGE"}}],"versions":["mariadb-10.1.16","mariadb-10.1.15","mariadb-10.1.14","mariadb-10.1.13","mariadb-10.1.12","mariadb-10.1.11","mariadb-10.1.10","mariadb-10.1.9","mariadb-10.1.8","mariadb-10.1.7","mariadb-10.1.6","mariadb-10.1.5","mariadb-10.1.4","mariadb-10.1.3","mariadb-10.1.2","mariadb-10.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-6662.json","vanir_signatures_modified":"2026-08-18T08:26:20Z","vanir_signatures":[{"target":{"file":"sql/item_sum.cc"},"deprecated":false,"digest":{"line_hashes":["284474919473169016970406210133607862503","56620395527721358171084621192052395955","155751907007791503660291135721680547973","284464292980216230235061452928340542994"],"threshold":0.9},"id":"CVE-2016-6662-16d79c87","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/a02642b66e06f95b80fa9ee592ba50eb61dc2f17"},{"signature_version":"v1","source":"https://github.com/mariadb/server/commit/a02642b66e06f95b80fa9ee592ba50eb61dc2f17","target":{"file":"sql/item_sum.cc","function":"Item_sum::register_sum_func"},"deprecated":false,"digest":{"length":1113,"function_hash":"260358408969056573440033318428069010350"},"id":"CVE-2016-6662-4f786aaf","signature_type":"Function"}]}},{"ranges":[{"type":"GIT","repo":"https://github.com/mysql/mysql-server","events":[{"introduced":"54df0057e18d8c82c23fbd4e0bf5b5dc2e762955"},{"last_affected":"754e7eff2872995e2b6e62f9da7448587a411c7b"},{"introduced":"0"},{"last_affected":"1235719370ff0a1e09e43c6eb825128d8caed647"},{"last_affected":"71f48ab393bce80a59e5a2e498cd1f46f6b43f9a"}],"database_specific":{"cpe":"cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.5.0"},{"last_affected":"5.5.52"},{"introduced":"5.6.0"},{"last_affected":"5.6.33"},{"introduced":"5.7.0"},{"last_affected":"5.7.15"}],"source":"CPE_RANGE"}}],"versions":["mysql-5.6.33","mysql-5.5.52","mysql-5.7.15","mysql-5.5.49","mysql-5.5.47","mysql-5.5.44","mysql-5.5.27","mysql-5.5.25","mysql-5.5.23","mysql-5.5.19","mysql-5.5.15","mysql-5.1.4","mysql-4.0.4","mysql-4.0.2","mysql-3.23.36","mysql-3.23.33","mysql-3.23.32","mysql-3.23.31","mysql-3.23.30-gamma","mysql-3.23.28-gamma","mysql-3.23.22-beta"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-6662.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/percona/percona-server","events":[{"introduced":"ba312212c98fb993434cc7420950102ecca7793d"},{"fixed":"b4a63b480bc048f8dbf053e52e3986d9965e47aa"},{"introduced":"0"},{"fixed":"8a8e01617c649c4fd5e8cc7e1bb9b402fc543887"},{"fixed":"4e95328f22c347ddd471c9acbc1e8ba8846eba01"}],"database_specific":{"cpe":"cpe:2.3:a:percona:percona_server:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.5"},{"fixed":"5.5.51-38.1"},{"introduced":"5.6"},{"fixed":"5.6.32-78.0"},{"introduced":"5.7"},{"fixed":"5.7.14-7"}],"source":"CPE_RANGE"}}],"versions":["Percona-Server-5.6.22-72.0","Percona-Server-5.5.35-33.0","Percona-Server-5.6.15-63.0","Percona-Server-5.5.34-32.0","Percona-Server-5.6.14-62.0","pre-null-merge","Percona-Server-5.6.5-60.0","last-PS-5.5-as-patches","clone-5.6.3-m6-build","clone-5.6.3-m5-build","clone-5.4.0-build","mysqlsummit-0.2.1-build","mysqlsummit-0.2.1","mysqlsummit-0.2.0","mysqlsummit-0.2.0-build","clone-5.1.31-pv-0.2.0-build","mysql-5.1.4","clone-5.1.4-build","clone-5.1.0-build","mysql-4.0.4","mysql-4.0.2","mysql-3.23.36","mysql-3.23.33","mysql-3.23.32","mysql-3.23.31","mysql-3.23.30-gamma","mysql-3.23.28-gamma","mysql_4.0","mysql-3.23.22-beta"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-6662.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}