Most recent entries from all

ALSA-2022:1556 — Moderate: mariadb:10.3 security and bug fix update

Affected: AlmaLinux:8: Judy, AlmaLinux:8: galera, AlmaLinux:8: mariadb, AlmaLinux:8: mariadb-backup, AlmaLinux:8: mariadb-common, AlmaLinux:8: mariadb-devel, AlmaLinux:8: mariadb-embedded, AlmaLinux:8: mariadb-embedded-devel, AlmaLinux:8: mariadb-errmsg, AlmaLinux:8: mariadb-gssapi-server and 5 more

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.32), galera (25.3.34). (BZ#2050543)

Security Fix(es):

* mysql: Server: DML unspecified vulnerability (CPU Apr 2021) (CVE-2021-2154)

* mysql: Server: DML unspecified vulnerability (CPU Apr 2021) (CVE-2021-2166)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2021) (CVE-2021-2372)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2021) (CVE-2021-2389)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2021) (CVE-2021-35604)

* mariadb: Integer overflow in sql_lex.cc integer leading to crash (CVE-2021-46667)

* mariadb: Crash in get_sort_by_table() in subquery with ORDER BY having outer ref (CVE-2021-46657)

* mariadb: save_window_function_values triggers an abort during IN subquery (CVE-2021-46658)

* mariadb: Crash in set_var.cc via certain UPDATE queries with nested subqueries (CVE-2021-46662)

* mariadb: Crash caused by mishandling of a pushdown from a HAVING clause to a WHERE clause (CVE-2021-46666)

* mariadb: No password masking in audit log when using ALTER USER <user> IDENTIFIED BY <password> command (BZ#1981332)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* mariadb:10.3/mariadb: /etc/security/user_map.conf getting over…

bdu:2021-02468

Withdrawn: BELL-CVE-2021-2154 — CVE-2021-2154 does not affect BellSoft software

Withdrawn by the publisher.

BIT-mariadb-2021-2154

Affected: Bitnami: mariadb

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

certfr-2021-avi-296 — De multiples vulnérabilités ont été découvertes dans Oracle MySQL. Certaines d'entre elles permettent à un attaquant de…

certfr-2021-avi-296

cnvd-2021-30880

EUVD-2026-188965

fkie_cve-2021-2154

FSA-202302 — Festo: Several vulnerabilities in FactoryViews

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

GHSA-c827-7w49-pg8j

gsd-2021-2154

ICSA-26-027-02 — Festo Didactic SE MES PC

MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications.

MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.

openSUSE-SU-2021:2605-1 — Security update for mariadb

Security update for mariadb

RHSA-2022:1007 — Red Hat Security Advisory: rh-mariadb105-mariadb security and bug fix update

mysql: Server: DML unspecified vulnerability (CPU Apr 2021) mysql: Server: DML unspecified vulnerability (CPU Apr 2021) mysql: InnoDB unspecified vulnerability (CPU Jul 2021) mysql: InnoDB unspecified vulnerability (CPU Jul 2021) mysql: InnoDB unspecified vulnerability (CPU Oct 2021) mariadb: Crash in get_sort_by_table() in subquery with ORDER BY having outer ref mariadb: save_window_function_values triggers an abort during IN subquery mariadb: Crash in set_var.cc via certain UPDATE queries with nested subqueries mariadb: Crash caused by mishandling of a pushdown from a HAVING clause to a WHERE clause mariadb: Integer overflow in sql_lex.cc integer leading to crash mysql: InnoDB unspecified vulnerability (CPU Apr 2022) mariadb: crash in Used_tables_and_const_cache::used_tables_and_const_cache_join mariadb: improper locking due to unreleased lock in the ds_xbstream.cc mariadb: DoS due to improper locking due to unreleased lock in plugin/server_audit/server_audit.c

SUSE-RU-2023:3956-1 — Recommended update for mariadb104

Recommended update for mariadb104

UBUNTU-CVE-2021-2154

Affected: Ubuntu:14.04:LTS: mysql-5.5, Ubuntu:Pro:16.04:LTS: mysql-5.7, Ubuntu:16.04:LTS: mariadb-10.0, Ubuntu:16.04:LTS: percona-server-5.6, Ubuntu:16.04:LTS: percona-xtradb-cluster-5.6, Ubuntu:18.04:LTS: mysql-5.7, Ubuntu:18.04:LTS: mariadb-10.1, Ubuntu:20.04:LTS: mariadb-10.3

WID-SEC-W-2023-0065 — Oracle MySQL: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.