Red Hat Security Advisory

RHSA-2017:2192

mariadb security and bug fix update

Released 2017-08-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) mariadb-1:5.5.56-2.el7, mariadb-libs-1:5.5.56-2.el7, mariadb-server-1:5.5.56-2.el7
Red Hat Enterprise Linux Client Optional (v. 7) mariadb-bench-1:5.5.56-2.el7, mariadb-devel-1:5.5.56-2.el7, mariadb-embedded-1:5.5.56-2.el7 +2
Red Hat Enterprise Linux ComputeNode (v. 7) mariadb-1:5.5.56-2.el7, mariadb-libs-1:5.5.56-2.el7
Red Hat Enterprise Linux ComputeNode Optional (v. 7) mariadb-bench-1:5.5.56-2.el7, mariadb-devel-1:5.5.56-2.el7, mariadb-embedded-1:5.5.56-2.el7 +3
Red Hat Enterprise Linux Server (v. 7) mariadb-1:5.5.56-2.el7, mariadb-bench-1:5.5.56-2.el7, mariadb-devel-1:5.5.56-2.el7 +5
Red Hat Enterprise Linux Server Optional (v. 7) mariadb-embedded-1:5.5.56-2.el7, mariadb-embedded-1:5.5.56-2.el7.ppc, mariadb-embedded-devel-1:5.5.56-2.el7 +1
Red Hat Enterprise Linux Workstation (v. 7) mariadb-1:5.5.56-2.el7, mariadb-bench-1:5.5.56-2.el7, mariadb-devel-1:5.5.56-2.el7 +3
Red Hat Enterprise Linux Workstation Optional (v. 7) mariadb-embedded-1:5.5.56-2.el7, mariadb-embedded-devel-1:5.5.56-2.el7

Fixes 19 records

TI-2017-02502 CVE-2017-3302 · GHSA-77pr-jpcv-9w4v

Use after free in Oracle MySQL Server

MEDIUM 47

Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04945 Published 2017-02-12 Partial fix CWE-416

TI-2017-02509 CVE-2017-3309 · GHSA-w87m-w678-grxc

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 39

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.03103 Published 2017-04-24 Partial fix

TI-2017-02508 CVE-2017-3308 · GHSA-3pr9-66rq-v5rm

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 39

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.03103 Published 2017-04-24 Partial fix

TI-2017-02438 CVE-2017-3238 · GHSA-6hx8-rgxq-6pp6

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 37

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04792 Published 2017-01-27 Partial fix

TI-2017-02795 CVE-2017-3600 · GHSA-w9mm-wmr9-fjjp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client…

LOW 36

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump).

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.02662 Published 2017-04-24 Partial fix

TI-2016-05709 CVE-2016-6664 · GHSA-f9x4-3x96-w2vf

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through…

LOW 36

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster befo…

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.02966 Published 2016-12-13 Partial fix CWE-59

TI-2017-02444 CVE-2017-3244 · GHSA-qwx7-fp8p-2j3c

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 35

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03707 Published 2017-01-27 Partial fix

TI-2017-02650 CVE-2017-3453 · GHSA-7967-57vf-g674

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03103 Published 2017-04-24 Partial fix

TI-2017-02458 CVE-2017-3258 · GHSA-r23c-pfc8-wx95

Improper input validation in Oracle MySQL Server

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03103 Published 2017-01-27 Partial fix CWE-20

TI-2017-02512 CVE-2017-3312 · GHSA-52jx-rfc6-628g

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 32

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging).

CVSS 3.1MEDIUM 6.7 Local Low privileges User interaction EPSS 0.00446 Published 2017-01-27 Partial fix

TI-2017-02491 CVE-2017-3291 · GHSA-q85r-m5q6-9v4f

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 30

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging).

CVSS 3.1MEDIUM 6.3 Local High privileges User interaction EPSS 0.00438 Published 2017-01-27 Partial fix

TI-2017-02653 CVE-2017-3456 · GHSA-r9xj-fg4h-7gwp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02989 Published 2017-04-24 Partial fix

TI-2017-02465 CVE-2017-3265 · GHSA-x6m4-gw2j-999q

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging).

CVSS 3.1MEDIUM 5.6 Local High privileges User interaction EPSS 0.0136 Published 2017-01-27 Partial fix

TI-2017-02443 CVE-2017-3243 · GHSA-43gh-2c4j-x343

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.04343 Published 2017-01-27 Partial fix

TI-2017-02843 CVE-2017-3651 · GHSA-h2r9-q8w8-hpcr

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client…

LOW 24

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0215 Published 2017-08-08 Partial fix

TI-2017-02661 CVE-2017-3464 · GHSA-4xm4-j6r9-v8m3

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

LOW 24

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0215 Published 2017-04-24 Partial fix

TI-2017-02513 CVE-2017-3313 · GHSA-9gmr-x7pv-f3xp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 22

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM).

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00422 Published 2017-01-27 Partial fix

TI-2017-02518 CVE-2017-3318 · GHSA-qwwx-r45m-fccp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error…

LOW 19

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error Handling).

CVSS 3.1MEDIUM 4.0 Local High privileges User interaction EPSS 0.00452 Published 2017-01-27 Partial fix

TI-2017-02517 CVE-2017-3317 · GHSA-6x64-rm6c-4p72

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging).

LOW 19

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging).

CVSS 3.1MEDIUM 4.0 Local High privileges User interaction EPSS 0.004 Published 2017-01-27 Partial fix