Monthly Archives: September 2016

Ubuntu

USN-3078-1: MySQL vulnerability

Ubuntu Security Notice USN-3078-1

13th September, 2016

mysql-5.5, mysql-5.7 vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

MySQL could be made to run programs as an administrator.

Software description

  • mysql-5.5
    – MySQL database

  • mysql-5.7
    – MySQL database

Details

Dawid Golunski discovered that MySQL incorrectly handled configuration
files. A remote attacker could possibly use this issue to execute arbitrary
code with root privileges.

MySQL has been updated to 5.5.52 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
Ubuntu 16.04 LTS has been updated to MySQL 5.7.15.

In addition to security fixes, the updated packages contain bug fixes,
new features, and possibly incompatible changes.

Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-51.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-52.html
http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-14.html
http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.04 LTS:
mysql-server-5.7

5.7.15-0ubuntu0.16.04.1
Ubuntu 14.04 LTS:
mysql-server-5.5

5.5.52-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
mysql-server-5.5

5.5.52-0ubuntu0.12.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2016-6662

US-CERT

Apple Releases Security Updates

Original release date: September 13, 2016

Apple has released security updates to address vulnerabilities in watchOS, Xcode, and iOS. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system.

Users and administrators are encouraged to review the Apple security page for watchOS, Xcode, and iOS and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Security

EMC Documentum D2 Authentication Bypass

EMC Documentum D2 contains fix for authentication bypass that could potentially be exploited by malicious users to compromise the affected system. By exploiting this vulnerability, remote unauthenticated users could download any document from the Docbase by knowing only the r_object_id of that document. Affected includes EMC Documentum D2 versions 4.5 earlier than patch 15 and EMC Documentum D2 versions 4.6 earlier than patch 03.