Oracle MySQL Connector/c vulnerabilities

2 CVEs affecting Oracle MySQL Connector/c, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-3635, published 2017-08-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-3152, published 2016-05-16. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle…
CVE-2017-3635, published 2017-08-08. Medium severity, CVSS 5.3. EPSS: 2% chance of exploitation in the next 30 days. Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/C). Supported versions that are affected are 6.1.10 and earlier. Difficult to exploit vulnerability allows low…