Red Hat Security Advisory

RHSA-2018:0574

rh-mariadb101-mariadb and rh-mariadb101-galera security and bug fix update

Released 2018-03-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-mariadb101-galera-25.3.12-12.el6, rh-mariadb101-mariadb-1:10.1.29-3.el6, rh-mariadb101-mariadb-bench-1:10.1.29-3.el6 +8
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-mariadb101-galera-25.3.12-12.el7, rh-mariadb101-mariadb-1:10.1.29-3.el7, rh-mariadb101-mariadb-bench-1:10.1.29-3.el7 +8
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-mariadb101-galera-25.3.12-12.el6, rh-mariadb101-mariadb-1:10.1.29-3.el6, rh-mariadb101-mariadb-bench-1:10.1.29-3.el6 +8
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-mariadb101-galera-25.3.12-12.el7, rh-mariadb101-mariadb-1:10.1.29-3.el7, rh-mariadb101-mariadb-bench-1:10.1.29-3.el7 +8
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-mariadb101-galera-25.3.12-12.el7, rh-mariadb101-mariadb-1:10.1.29-3.el7, rh-mariadb101-mariadb-bench-1:10.1.29-3.el7 +8
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-mariadb101-galera-25.3.12-12.el6, rh-mariadb101-mariadb-1:10.1.29-3.el6, rh-mariadb101-mariadb-bench-1:10.1.29-3.el6 +8
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-mariadb101-galera-25.3.12-12.el7, rh-mariadb101-mariadb-1:10.1.29-3.el7, rh-mariadb101-mariadb-bench-1:10.1.29-3.el7 +8

Fixes 26 records

TI-2017-02502 CVE-2017-3302 · GHSA-77pr-jpcv-9w4v

Use after free in Oracle MySQL Server

MEDIUM 47

Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04945 Published 2017-02-12 Partial fix CWE-416

TI-2017-02509 CVE-2017-3309 · GHSA-w87m-w678-grxc

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 39

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.03103 Published 2017-04-24 Partial fix

TI-2017-02508 CVE-2017-3308 · GHSA-3pr9-66rq-v5rm

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 39

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.03103 Published 2017-04-24 Partial fix

TI-2017-02438 CVE-2017-3238 · GHSA-6hx8-rgxq-6pp6

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 37

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04792 Published 2017-01-27 Partial fix

TI-2016-05709 CVE-2016-6664 · GHSA-f9x4-3x96-w2vf

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through…

LOW 36

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster befo…

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.02966 Published 2016-12-13 Partial fix CWE-59

TI-2017-07717 CVE-2017-10378 · GHSA-wp4q-xxr9-wwm7

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 35

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03264 Published 2017-10-19 Partial fix

TI-2017-02444 CVE-2017-3244 · GHSA-qwx7-fp8p-2j3c

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 35

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03707 Published 2017-01-27 Partial fix

TI-2017-07723 CVE-2017-10384 · GHSA-w2fh-3rw7-vr98

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03103 Published 2017-10-19 Partial fix

TI-2017-02650 CVE-2017-3453 · GHSA-7967-57vf-g674

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03103 Published 2017-04-24 Partial fix

TI-2017-02458 CVE-2017-3258 · GHSA-r23c-pfc8-wx95

Improper input validation in Oracle MySQL Server

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03103 Published 2017-01-27 Partial fix CWE-20

TI-2017-02457 CVE-2017-3257 · GHSA-4vfm-qwr5-7w89

Improper privilege management in Oracle MySQL Server

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0257 Published 2017-01-27 Fixed CWE-269

TI-2017-07718 CVE-2017-10379 · GHSA-hr5m-vvhf-96cx

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client…

LOW 33

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02298 Published 2017-10-19 Partial fix CWE-863

TI-2017-02512 CVE-2017-3312 · GHSA-52jx-rfc6-628g

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 32

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging).

CVSS 3.1MEDIUM 6.7 Local Low privileges User interaction EPSS 0.00446 Published 2017-01-27 Partial fix

TI-2017-02491 CVE-2017-3291 · GHSA-q85r-m5q6-9v4f

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 30

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging).

CVSS 3.1MEDIUM 6.3 Local High privileges User interaction EPSS 0.00438 Published 2017-01-27 Partial fix

TI-2017-02833 CVE-2017-3641 · GHSA-pvvc-fmf7-5pf7

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.03225 Published 2017-08-08 Partial fix

TI-2017-02653 CVE-2017-3456 · GHSA-r9xj-fg4h-7gwp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02989 Published 2017-04-24 Partial fix

TI-2017-02465 CVE-2017-3265 · GHSA-x6m4-gw2j-999q

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging).

CVSS 3.1MEDIUM 5.6 Local High privileges User interaction EPSS 0.0136 Published 2017-01-27 Partial fix

TI-2017-02443 CVE-2017-3243 · GHSA-43gh-2c4j-x343

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 28

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.04343 Published 2017-01-27 Partial fix

TI-2017-07637 CVE-2017-10286 · GHSA-96j4-972j-4fr2

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 25

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.02444 Published 2017-10-19 Fixed

TI-2017-02828 CVE-2017-3636 · GHSA-c28x-42jj-83gc

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client…

LOW 24

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs).

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00438 Published 2017-08-08 Partial fix

TI-2017-02661 CVE-2017-3464 · GHSA-4xm4-j6r9-v8m3

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

LOW 24

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0215 Published 2017-04-24 Partial fix

TI-2017-02513 CVE-2017-3313 · GHSA-9gmr-x7pv-f3xp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 22

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM).

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00422 Published 2017-01-27 Partial fix

TI-2017-07619 CVE-2017-10268 · GHSA-v298-4xpp-8q7w

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 20

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication).

CVSS 3.1MEDIUM 4.1 Local High privileges No interaction EPSS 0.00702 Published 2017-10-19 Partial fix

TI-2017-02845 CVE-2017-3653 · GHSA-fhc7-95hq-9w87

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

LOW 19

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.01887 Published 2017-08-08 Partial fix

TI-2017-02518 CVE-2017-3318 · GHSA-qwwx-r45m-fccp

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error…

LOW 19

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error Handling).

CVSS 3.1MEDIUM 4.0 Local High privileges User interaction EPSS 0.00452 Published 2017-01-27 Partial fix

TI-2017-02517 CVE-2017-3317 · GHSA-6x64-rm6c-4p72

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging).

LOW 19

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging).

CVSS 3.1MEDIUM 4.0 Local High privileges User interaction EPSS 0.004 Published 2017-01-27 Partial fix