What’s Vulnerable › Vulnerabilities

CVE-2017-15945

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-10-27 · updated 2026-06-17
• Weakness: CWE-732

Description

The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera packages before 2017-09-29 have chown calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to the mysql account for creation of a link.

Affected products

• MariaDB: before 10.0.30 — fixed in 10.0.30
• Mysql: before 5.6.36 — fixed in 5.6.36

How to fix

Upgrade to a fixed version: MariaDB 10.0.30; Mysql 5.6.36. Check the vendor advisory for mitigations.

References

• https://bugs.gentoo.org/630822
• https://security.gentoo.org/glsa/201711-04
• https://bugs.gentoo.org/630822
• https://security.gentoo.org/glsa/201711-04

Get alerted when CVE-2017-15945 or the next vulnerability affects your stack