Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Authentication). Supported versions that are affected are 5.6.29 and earlier and 5.7.11 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server.
Reviewing commits between 5.6.29 and 5.6.30, it seems this CVE is for the following fix:
which is documented in release notes as:
Integer overflow could occur during client handshake processing, leading to
a server exit. (Bug #22722946)
The fix prevents out of bounds read, which could cause server crash as mentioned in the release notes. Oracle CVSS scoring implies worse impact - CIA:C / CIA:H can imply code execution (e.g. if the buffer pointer that gets out of bounds is later not only read form, but also written to, leading to memory corruption), or authentication bypass (as this flaw occurs as part of the handshake packet parsing; but such impact does not seem likely).
Affected code does not exist in older MySQL versions (5.5 and earlier) and MariaDB. It seems this commit introduced the main problem:
Hence version 5.6.6 and later should be affected.
This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
Red Hat Software Collections for Red Hat Enterprise Linux 6
Red Hat Software Collections for Red Hat Enterprise Linux 7
Via RHSA-2016:0705 https://rhn.redhat.com/errata/RHSA-2016-0705.html