# CVE-2017-3318: Oracle MySQL Server information disclosure in Error Handling

Source: https://junglewise.ai/threats/cve-2017-3318-oracle-mysql-server-information-disclosure-in-error-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-3318 · Severity: medium · CVSS 4 · Published 2017-01-27

A vulnerability in the error handling component of Oracle MySQL and MariaDB could allow a highly privileged user to gain unauthorized access to sensitive database information. To exploit this, an attacker must already have significant access to the underlying server infrastructure and requires a separate user to perform a specific action. While difficult to execute, a successful attack could lead to the exposure of all data stored within the database.

Technologies: [Oracle MySQL Server](https://junglewise.ai/threats/technologies/mysql-server). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2017-3318 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-3318 being exploited in the wild.

**How severe is CVE-2017-3318?** Medium severity, with a CVSS score of 4, published 27 January 2017.

**Which products and versions are affected?** Oracle MySQL Server 5.5.53 and earlier, 5.6.34 and earlier, 5.7.16 and earlier.

**Is there a fix for CVE-2017-3318?** A patch was published on 2017-01-19: Debian released fixed mysql-5.5 packages (5.5.54-0+deb8u1) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-3318 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2017-3318?** Check whether you run Oracle MySQL Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability exists in the Error Handling subcomponent of MySQL Server (versions 5.5.53, 5.6.34, 5.7.16 and earlier) and MariaDB. It is classified as a local vulnerability requiring high privileges (PR:H) and high attack complexity (AC:H). An attacker with existing logon access to the infrastructure where the server executes can exploit this flaw to gain unauthorized access to critical data. The exploit requires interaction from a person other than the attacker (UI:R). Patches were released in MySQL 5.5.54, 5.6.35, and 5.7.17, as well as MariaDB 10.0.29 and 10.1.21.

## Affected products

- Oracle MySQL Server 5.5.53 and earlier, 5.6.34 and earlier, 5.7.16 and earlier
- MariaDB Foundation MariaDB 5.5.0 to 5.5.53, 10.0.0 to 10.0.28, 10.1.0 to 10.1.20

## Timeline

- 2017-01-17: advisory: Oracle Critical Patch Update (CPU) January 2017 released
- 2017-01-19: patched: Debian released fixed mysql-5.5 packages (5.5.54-0+deb8u1)
- 2017-01-22: patched: Debian released fixed mariadb-10.0 packages (10.0.29-0+deb8u1)
- 2017-01-27: disclosed: NVD publication date

## References

- [http://www.debian.org/security/2017/dsa-3767](http://www.debian.org/security/2017/dsa-3767)
- [http://www.debian.org/security/2017/dsa-3770](http://www.debian.org/security/2017/dsa-3770)
- [http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html](http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html)
- [http://www.securityfocus.com/bid/95588](http://www.securityfocus.com/bid/95588)
- [http://www.securitytracker.com/id/1037640](http://www.securitytracker.com/id/1037640)
- [https://access.redhat.com/errata/RHSA-2017:2192](https://access.redhat.com/errata/RHSA-2017:2192)
- [https://access.redhat.com/errata/RHSA-2017:2787](https://access.redhat.com/errata/RHSA-2017:2787)

## Related threats

- [Oracle MySQL Server XML parsing privilege escalation](https://junglewise.ai/threats/cve-2026-101803-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server parser denial of service](https://junglewise.ai/threats/cve-2026-101802-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server Optimizer denial of service](https://junglewise.ai/threats/cve-2026-101801-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server privilege escalation in Security: Privileges](https://junglewise.ai/threats/cve-2026-101800-vulnerability-in-the-mysql-server-mysql-cluster-product-of)
- [Oracle MySQL Server denial of service in Group Replication](https://junglewise.ai/threats/cve-2026-101799-vulnerability-in-the-mysql-server-mysql-cluster-product-of)