Red Hat Security Advisory

RHSA-2015:1665

mariadb security update

Released 2015-08-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) mariadb-1:5.5.44-1.el7_1, mariadb-libs-1:5.5.44-1.el7_1, mariadb-server-1:5.5.44-1.el7_1
Red Hat Enterprise Linux Client Optional (v. 7) mariadb-bench-1:5.5.44-1.el7_1, mariadb-devel-1:5.5.44-1.el7_1, mariadb-embedded-1:5.5.44-1.el7_1 +2
Red Hat Enterprise Linux ComputeNode (v. 7) mariadb-1:5.5.44-1.el7_1, mariadb-libs-1:5.5.44-1.el7_1
Red Hat Enterprise Linux ComputeNode Optional (v. 7) mariadb-bench-1:5.5.44-1.el7_1, mariadb-devel-1:5.5.44-1.el7_1, mariadb-embedded-1:5.5.44-1.el7_1 +3
Red Hat Enterprise Linux Server (v. 7) mariadb-1:5.5.44-1.ael7b_1, mariadb-1:5.5.44-1.el7_1, mariadb-bench-1:5.5.44-1.ael7b_1 +11
Red Hat Enterprise Linux Server Optional (v. 7) mariadb-embedded-1:5.5.44-1.ael7b_1, mariadb-embedded-1:5.5.44-1.el7_1, mariadb-embedded-1:5.5.44-1.el7_1.ppc +3
Red Hat Enterprise Linux Workstation (v. 7) mariadb-1:5.5.44-1.el7_1, mariadb-bench-1:5.5.44-1.el7_1, mariadb-devel-1:5.5.44-1.el7_1 +3
Red Hat Enterprise Linux Workstation Optional (v. 7) mariadb-embedded-1:5.5.44-1.el7_1, mariadb-embedded-devel-1:5.5.44-1.el7_1

Fixes 17 records

TI-2015-00462 CVE-2015-0501 · GHSA-7m5h-2c3p-4m2w

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and…

LOW 38

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.

CVSS 2.0MEDIUM 5.7 Network Low privileges Interaction — EPSS 0.10263 Published 2015-04-16 Partial fix

TI-2015-02785 CVE-2015-3152 · GHSA-p7qr-v5jx-7qv3

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3…

LOW 36

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof server…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.07141 Published 2016-05-16 Partial fix CWE-295

TI-2015-02257 CVE-2015-2568 · GHSA-6q8f-4h67-ww32

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and…

LOW 33

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07157 Published 2015-04-16 Partial fix

TI-2015-02308 CVE-2015-2620 · GHSA-w97j-x2ff-rr4p

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and…

LOW 28

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0472 Published 2015-07-16 Partial fix

TI-2015-03979 CVE-2015-4757 · GHSA-vx7r-p6jx-hf82

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and…

LOW 27

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.06915 Published 2015-07-16 Partial fix

TI-2015-02261 CVE-2015-2573 · GHSA-3gxj-c7jw-c2w5

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and…

LOW 27

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.05116 Published 2015-04-16 Partial fix

TI-2015-02259 CVE-2015-2571 · GHSA-4fvx-6pv8-2rxh

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and…

LOW 27

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.05323 Published 2015-04-16 Partial fix

TI-2015-00397 CVE-2015-0433 · GHSA-gw5v-pjxv-pj3h

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and…

LOW 27

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to InnoDB : DML.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.05427 Published 2015-04-16 Partial fix

TI-2015-03974 CVE-2015-4752 · GHSA-j985-v78q-pcwf

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and…

LOW 26

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to Server : I_S.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.04083 Published 2015-07-16 Partial fix

TI-2015-02336 CVE-2015-2648 · GHSA-qc49-rpfg-7h6m

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and…

LOW 26

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.04333 Published 2015-07-16 Partial fix

TI-2015-02331 CVE-2015-2643 · GHSA-mhfw-jv7r-2344

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and…

LOW 26

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.04333 Published 2015-07-16 Partial fix

TI-2015-02270 CVE-2015-2582 · GHSA-fw8r-p4q8-w66f

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and…

LOW 26

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to GIS.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.04333 Published 2015-07-16 Partial fix

TI-2015-00405 CVE-2015-0441 · GHSA-c6jx-5466-w64m

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and…

LOW 26

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Encryption.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.0451 Published 2015-04-16 Partial fix

TI-2015-00466 CVE-2015-0505 · GHSA-qmpq-vv9h-qcm9

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and…

LOW 25

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.0519 Published 2015-04-16 Partial fix

TI-2015-00460 CVE-2015-0499 · GHSA-h9f2-jxcx-f5wh

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and…

LOW 25

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.04892 Published 2015-04-16 Partial fix

TI-2015-03959 CVE-2015-4737 · GHSA-rc67-r6fc-3mxg

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and…

LOW 23

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth.

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.0362 Published 2015-07-16 Partial fix

TI-2015-04082 CVE-2015-4864 · GHSA-78fj-8qvw-m3wg

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and…

LOW 21

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.02388 Published 2015-10-21 Partial fix