CVE-2017-3523

Name	CVE-2017-3523
Description	Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-945-1, DSA-3840-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mysql-connector-java (PTS)	jessie, jessie (lts)	5.1.49-0+deb8u1	fixed
	stretch (security), stretch (lts), stretch	5.1.49-0+deb9u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
mysql-connector-java	source	wheezy	5.1.42-1~deb7u1	DLA-945-1
mysql-connector-java	source	jessie	5.1.41-1~deb8u1	DSA-3840-1
mysql-connector-java	source	(unstable)	5.1.41-1

https://www.computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt