oss-sec mailing list archives
Re: MySQL / MariaDB / Percona - Root Privilege Escalation Exploit [ CVE-2016-6664 / CVE-2016-5617 ]
From: Tomas Hoger <thoger () redhat com>
Date: Fri, 3 Mar 2017 14:17:19 +0100
Hi Dawid! On Fri, 17 Feb 2017 12:03:44 -0200 Dawid Golunski wrote:
Yes, I have reported the insufficient fixes to Oracle and related vendors. I wanted to allow some more time for patching before making these public. I will make my advisories and exploits public soon.
Can you clarify if the "soon" above is supposed to mean days, weeks, or months? Two weeks have passed since the above, and I've not seen any update from you. Note that I'm only asking for CVE mappings for issues that were publicly fixed and mentioned in release notes mid-Dec, listed in Oracle CPU mid-Jan, and had enough technical details noted in this thread or other public bug reports. Only giving CVE names to known issues does not hurt anyone, and it actually helps downstreams and users already hurt by upstream's proprietary attitude towards this open-source project. Of course, it's up to your discretion if and when to release working exploits, videos, etc. Thank you! -- Tomas Hoger / Red Hat Product Security
Current thread:
- Re: MySQL / MariaDB / Percona - Root Privilege Escalation Exploit [ CVE-2016-6664 / CVE-2016-5617 ] Tomas Hoger (Feb 17)
- Re: MySQL / MariaDB / Percona - Root Privilege Escalation Exploit [ CVE-2016-6664 / CVE-2016-5617 ] Dawid Golunski (Feb 17)
- Re: MySQL / MariaDB / Percona - Root Privilege Escalation Exploit [ CVE-2016-6664 / CVE-2016-5617 ] Tomas Hoger (Mar 03)
- Re: MySQL / MariaDB / Percona - Root Privilege Escalation Exploit [ CVE-2016-6664 / CVE-2016-5617 ] Dawid Golunski (Feb 17)