Most recent entries from all

ALSA-2023:5259 — Moderate: mariadb:10.3 security, bug fix, and enhancement update

Affected: AlmaLinux:8: Judy, AlmaLinux:8: galera, AlmaLinux:8: mariadb, AlmaLinux:8: mariadb-backup, AlmaLinux:8: mariadb-common, AlmaLinux:8: mariadb-devel, AlmaLinux:8: mariadb-embedded, AlmaLinux:8: mariadb-embedded-devel, AlmaLinux:8: mariadb-errmsg, AlmaLinux:8: mariadb-gssapi-server and 5 more

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3). (BZ#2223572, BZ#2223574, BZ#2223962, BZ#2223965)

Security Fix(es):

* mariadb: segmentation fault via the component sub_select (CVE-2022-32084) * mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091) * mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791) * mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* [MariaDB 10.3.32] socat: E Failed to set SNI host "" (SST failure) (BZ#2223961)

bdu:2023-03856

Withdrawn: BELL-CVE-2022-47015 — CVE-2022-47015 does not affect BellSoft software

Withdrawn by the publisher.

BIT-mariadb-2022-47015

Affected: Bitnami: mariadb

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

certfr-2024-avi-0619 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2024-avi-0619

EUVD-2026-226912

fkie_cve-2022-47015

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

FSA-202302 — Festo: Several vulnerabilities in FactoryViews

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

GHSA-hc8h-974x-98hr

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

gsd-2022-47015

msrc_CVE-2022-47015 — MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mba…

msrc_CVE-2022-47015

OESA-2023-1830 — mariadb security update

Affected: openEuler:20.03-LTS-SP1: mariadb, openEuler:20.03-LTS-SP3: mariadb, openEuler:22.03-LTS: mariadb, openEuler:22.03-LTS-SP1: mariadb, openEuler:22.03-LTS-SP2: mariadb

MariaDB turns data into structured information in a wide array of applications, ranging from banking to websites. It is an enhanced, drop-in replacement for MySQL. MariaDB is used because it is fast, scalable and robust, with a rich ecosystem of storage engines, plugins and many other tools make it very versatile for a wide variety of use cases. Security Fix(es): The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other appli…

openSUSE-SU-2024:12956-1 — libmariadbd-devel-10.11.3-1.1 on GA media

libmariadbd-devel-10.11.3-1.1 on GA media

RHSA-2023:5259 — Red Hat Security Advisory: mariadb:10.3 security, bug fix, and enhancement update

mariadb: segmentation fault via the component sub_select mariadb: server crash in JOIN_CACHE::free or in copy_fields mariadb: compress_write() fails to release mutex on failure mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6

SUSE-RU-2023:3956-1 — Recommended update for mariadb104

Recommended update for mariadb104

UBUNTU-CVE-2022-47015

Affected: Ubuntu:20.04:LTS: mariadb-10.3, Ubuntu:22.04:LTS: mariadb-10.6

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

WID-SEC-W-2023-0167 — MariaDB: Schwachstelle ermöglicht Denial of Service

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MariaDB ausnutzen, um einen Denial of Service Angriff durchzuführen.