CVE-2016-6662
CriticalExploitedPublic exploitmysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)
Published Sep 20, 2016 · Updated Jul 8, 2026 · Also known as ALPINE-CVE-2016-6662, DEBIAN-CVE-2016-6662, DLA-624-1, DSA-3666-1, SUSE-SU-2016:2395-1, SUSE-SU-2016:2404-1, UBUNTU-CVE-2016-6662, USN-3078-1
Key Facts
Patch immediately- CVE-2016-6662 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Mariadb, Mysql (Oracle), Percona Server and 22 more products.
- It is exploited in the wild, listed in Industry KEV feed since May 14, 2024. Public exploit code is available.
- EPSS estimates a 68% probability of exploitation in the next 30 days.
- Fixed versions are available, including liblz4-1 1.8.0-3.5.2, libmariadb_plugins 3.1.22-2.35.1, libmariadb-devel 3.1.22-2.35.1.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
68%
Higher than 99.3% of all scored CVEs
Exploited in the wild
Yes
1 catalog listing
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2016-6662 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | May 14, 2024 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
355 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| MariadbMariadb | See advisory | 5.5.51 |
| MysqlOracle | See advisory | 5.5.52 |
| Percona ServerPercona | See advisory | 5.5.51-38.1 |
| OpenstackRedhat | 5.0, 6.0, 7.0, 8, 9 | n/a |
| Debian LinuxDebian | 8.0 | n/a |
Patched Releases
liblz4-1
1.8.0-3.5.2
libmariadb_plugins
3.1.22-2.35.1
libmariadb-devel
3.1.22-2.35.1
libmariadb3
3.1.22-2.35.1
libmariadbd104-devel
10.4.30-150100.3.5.10, 10.4.30-8.5.46
libmariadbd19
10.4.30-150100.3.5.10, 10.4.30-8.5.46
libmysql55client_r18
5.5.52-0.27.1, 5.5.53-0.30.1
libmysql55client_r18-32bit
5.5.52-0.27.1, 5.5.53-0.30.1
libmysql55client_r18-x86
5.5.52-0.27.1, 5.5.53-0.30.1
libmysql55client18
5.5.52-0.27.1, 5.5.53-0.30.1
libmysql55client18-32bit
5.5.52-0.27.1, 5.5.53-0.30.1
libmysql55client18-x86
5.5.52-0.27.1, 5.5.53-0.30.1
libmysql56client_r18
5.6.34-1.1, 5.6.34-19.2
libmysql56client_r18-32bit
5.6.34-1.1, 5.6.34-19.2
libmysql56client18
5.6.34-1.1, 5.6.34-19.2
libmysql56client18-32bit
5.6.34-1.1, 5.6.34-19.2
libmysqlclient_r18
10.0.27-12.1, 10.0.27-2.27.1, 10.0.27-20.13.1
libmysqlclient_r18-32bit
10.0.27-12.1, 10.0.27-2.27.1
libmysqlclient-devel
10.0.27-12.1, 10.0.27-2.27.1, 10.0.27-20.13.1
libmysqlclient18
10.0.27-12.1, 10.0.27-2.27.1, 10.0.27-20.13.1
libmysqlclient18-32bit
10.0.27-12.1, 10.0.27-2.27.1, 10.0.27-20.13.1
libmysqlclient18-debuginfo
10.0.27-2.27.1
libmysqlclient18-debuginfo-32bit
10.0.27-2.27.1
libmysqld-devel
10.0.27-12.1, 10.0.27-2.27.1, 10.0.27-20.13.1
libmysqld18
10.0.27-12.1, 10.0.27-2.27.1, 10.0.27-20.13.1
Timeline
Publicly disclosed
Sep 20, 2016
Added to Industry KEV feed
May 14, 2024
Last updated
Jul 8, 2026
Weakness Type
- CWE-264
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
- advisoryhttp://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html
- advisoryRHSA-2016:2058
- advisoryRHSA-2016:2059
- advisoryRHSA-2016:2060
- advisoryRHSA-2016:2061
FAQ
Common Questions.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protec…
Affected: Mariadb; Mysql (Oracle); Percona Server, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since May 14, 2024.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including liblz4-1 1.8.0-3.5.2, libmariadb_plugins 3.1.22-2.35.1, libmariadb-devel 3.1.22-2.35.1.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2016-6662 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo