Most recent entries from all

ALSA-2021:1242 — Important: mariadb:10.3 and mariadb-devel:10.3 security update

Affected: AlmaLinux:8: Judy, AlmaLinux:8: Judy-devel, AlmaLinux:8: asio-devel, AlmaLinux:8: galera, AlmaLinux:8: mariadb, AlmaLinux:8: mariadb-backup, AlmaLinux:8: mariadb-common, AlmaLinux:8: mariadb-devel, AlmaLinux:8: mariadb-embedded, AlmaLinux:8: mariadb-embedded-devel and 7 more

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb (10.3.28), galera (25.3.32). Security Fix(es): * mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user (CVE-2021-27928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-03770

Withdrawn: BELL-CVE-2021-27928 — CVE-2021-27928 does not affect BellSoft software

Withdrawn by the publisher.

BIT-mariadb-2021-27928

Affected: Bitnami: mariadb

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.

certfr-2022-avi-477 — Une vulnérabilité a été découverte dans IBM PowerVC. Elle permet à un attaquant de provoquer une exécution de code arbi…

certfr-2022-avi-477

EUVD-2026-25749

fkie_cve-2021-27928

FSA-202302 — Festo: Several vulnerabilities in FactoryViews

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

GHSA-2q7x-w5q3-rjxc

gsd-2021-27928

ICSA-26-027-02 — Festo Didactic SE MES PC

MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications.

MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.

msrc_CVE-2021-27928 — A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37 10.3 before 10.3.28 10.4 before 10.4.18 and…

msrc_CVE-2021-27928

OESA-2021-1250 — mariadb security update

Affected: openEuler:20.03-LTS-SP1: mariadb

MariaDB turns data into structured information in a wide array of applications, ranging from banking to websites. It is an enhanced, drop-in replacement for MySQL. MariaDB is used because it is fast, scalable and robust, with a rich ecosystem of storage engines, plugins and many other tools make it very versatile for a wide variety of use cases. Security Fix(es): A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.(CVE-2021-27928) A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.(CVE-2020-15180)

openSUSE-SU-2021:2605-1 — Security update for mariadb

Security update for mariadb

RHSA-2021:1039 — Red Hat Security Advisory: mariadb security update

mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user

SUSE-RU-2023:3956-1 — Recommended update for mariadb104

Recommended update for mariadb104

UBUNTU-CVE-2021-27928

Affected: Ubuntu:16.04:LTS: percona-server-5.6, Ubuntu:18.04:LTS: mariadb-10.1, Ubuntu:20.04:LTS: mariadb-10.3

WID-SEC-W-2023-2463 — MariaDB: Schwachstelle ermöglicht nicht spezifizierten Angriff

Ein Angreifer kann eine Schwachstelle in MariaDB ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.