Red Hat Security Advisory

RHSA-2023:6821

mariadb:10.5 security update

Released 2023-11-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream AUS (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5 +16
Red Hat Enterprise Linux AppStream E4S (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.aarch64::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.s390x::mariadb:10.5 +47
Red Hat Enterprise Linux AppStream TUS (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5 +16

Fixes 63 records

TI-2023-04745 CVE-2023-5157 · GHSA-6589-j38p-mm8c

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

MEDIUM 43

A vulnerability was found in MariaDB.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02256 Published 2023-09-26 Fixed in 8080020230814130040.63b34585, 8080020231003163755.63b34585 +8 CWE-400

TI-2022-10443 CVE-2022-27387 · GHSA-cw8p-532r-7gqx

MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the…

LOW 38

MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02458 Published 2022-04-12 Partial fix CWE-120

TI-2022-13851 CVE-2022-32091 · GHSA-85h8-46x6-w44w

MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at…

LOW 37

MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02367 Published 2022-07-01 Partial fix CWE-416

TI-2022-13850 CVE-2022-32089 · GHSA-mvw8-35pm-hmgm

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component…

LOW 37

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02194 Published 2022-07-01 Partial fix

TI-2022-13849 CVE-2022-32088 · GHSA-cwg9-vp4r-v3q2

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component…

LOW 37

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02024 Published 2022-07-01 Partial fix

TI-2022-13846 CVE-2022-32085 · GHSA-44q2-c8m6-j2gg

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component…

LOW 37

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02024 Published 2022-07-01 Partial fix

TI-2022-13845 CVE-2022-32084 · GHSA-qcx8-8xph-pfh5

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.

LOW 37

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02276 Published 2022-07-01 Partial fix

TI-2022-13844 CVE-2022-32083 · GHSA-cxcg-577f-2582

MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component…

LOW 37

MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02007 Published 2022-07-01 Partial fix

TI-2022-13843 CVE-2022-32082 · GHSA-hx5h-h8m3-hvw4

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

LOW 37

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02109 Published 2022-07-01 Partial fix CWE-617

TI-2022-13842 CVE-2022-32081 · GHSA-vcx9-8fp4-h37w

MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in…

LOW 37

MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02212 Published 2022-07-01 Partial fix CWE-416

TI-2022-10478 CVE-2022-27456 · GHSA-f8w6-xxmj-9fw4

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the…

LOW 37

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02125 Published 2022-04-14 Partial fix CWE-416

TI-2022-10476 CVE-2022-27452 · GHSA-xmmc-5876-ffjc

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.

LOW 37

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02186 Published 2022-04-14 Partial fix

TI-2022-10474 CVE-2022-27449 · GHSA-fpv9-9h63-pjx6

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.

LOW 37

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02229 Published 2022-04-14 Partial fix

TI-2022-10473 CVE-2022-27448 · GHSA-48pm-mhwh-g6mr

There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos…

LOW 37

There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02151 Published 2022-04-14 Partial fix CWE-617

TI-2022-10472 CVE-2022-27447 · GHSA-x3q7-35r8-p299

MariaDB Server v10.9 and below was discovered to contain a use-after-free via the…

LOW 37

MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02246 Published 2022-04-14 Partial fix CWE-416

TI-2022-10470 CVE-2022-27445 · GHSA-2qrm-3wph-84mx

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.

LOW 37

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02174 Published 2022-04-14 Partial fix

TI-2022-10442 CVE-2022-27386 · GHSA-2h3p-557r-42m3

MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.

LOW 37

MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02264 Published 2022-04-12 Partial fix CWE-89

TI-2022-10440 CVE-2022-27384 · GHSA-247x-4435-qv9r

An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6…

LOW 37

An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02193 Published 2022-04-12 Partial fix CWE-89

TI-2022-10439 CVE-2022-27383 · GHSA-53wc-v4mf-xrvp

MariaDB Server v10.6 and below was discovered to contain an use-after-free in the…

LOW 37

MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0213 Published 2022-04-12 Partial fix CWE-416

TI-2022-10437 CVE-2022-27381 · GHSA-4mvf-f4q5-j3rq

An issue in the component Field::set_default of MariaDB Server v10.6 and below was…

LOW 37

An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02193 Published 2022-04-12 Partial fix CWE-89

TI-2022-10436 CVE-2022-27380 · GHSA-8gjp-gp42-7qg3

An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was…

LOW 37

An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02264 Published 2022-04-12 Partial fix CWE-89

TI-2022-10435 CVE-2022-27379 · GHSA-m42w-339f-jp66

An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2…

LOW 37

An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02264 Published 2022-04-12 Partial fix CWE-89

TI-2022-10434 CVE-2022-27378 · GHSA-g3vp-fwv2-p6m7

An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below…

LOW 37

An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02406 Published 2022-04-12 Partial fix CWE-89

TI-2022-10433 CVE-2022-27377 · GHSA-99jw-w9c8-f6wv

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the…

LOW 37

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02337 Published 2022-04-12 Partial fix CWE-416

TI-2022-10432 CVE-2022-27376 · GHSA-x3qj-5vwp-jfh8

MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the…

LOW 37

MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02199 Published 2022-04-12 Partial fix CWE-416

TI-2021-21441 CVE-2021-46669 · GHSA-wrw9-g9r9-p9h2

MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free…

LOW 37

MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02423 Published 2022-02-01 Partial fix CWE-416

TI-2021-02058 CVE-2021-2389 · GHSA-xrfh-762q-x6xj

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 37

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.08149 Published 2021-07-20 Partial fix

TI-2022-13848 CVE-2022-32087 · GHSA-hc55-j7j2-f8w9

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.

LOW 36

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01788 Published 2022-07-01 Partial fix

TI-2022-13847 CVE-2022-32086 · GHSA-8rp2-7jc6-wrw4

MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.

LOW 36

MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0156 Published 2022-07-01 Partial fix

TI-2022-10479 CVE-2022-27457 · GHSA-4v3m-fhx4-qp25

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the…

LOW 36

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01663 Published 2022-04-14 Partial fix CWE-416

TI-2022-10477 CVE-2022-27455 · GHSA-5265-h4f9-w9cf

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the…

LOW 36

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01564 Published 2022-04-14 Partial fix CWE-416

TI-2022-10475 CVE-2022-27451 · GHSA-7php-c48c-5jgv

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.

LOW 36

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01663 Published 2022-04-14 Partial fix

TI-2022-10471 CVE-2022-27446 · GHSA-vfrr-qwmc-g5r4

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.

LOW 36

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01579 Published 2022-04-14 Partial fix

TI-2022-10469 CVE-2022-27444 · GHSA-pc84-v5fr-8p3f

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.

LOW 36

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01485 Published 2022-04-14 Partial fix

TI-2022-10441 CVE-2022-27385 · GHSA-m469-6q82-xqvx

An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join…

LOW 36

An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL sta…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01658 Published 2022-04-12 Partial fix CWE-89

TI-2022-10438 CVE-2022-27382 · GHSA-6hwc-564p-37h2

MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the…

LOW 36

MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01546 Published 2022-04-12 Partial fix CWE-617

TI-2022-08012 CVE-2022-24052 · GHSA-pfvf-3927-r9fx

Heap-based buffer overflow in MariaDB

LOW 35

MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00694 Published 2022-02-18 Partial fix CWE-122

TI-2022-08011 CVE-2022-24051 · GHSA-8c8g-735r-wqqj

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability.

LOW 35

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00662 Published 2022-02-18 Partial fix CWE-134

TI-2022-08010 CVE-2022-24050 · GHSA-x653-r3p3-jh2f

Use after free in MariaDB

LOW 35

MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00644 Published 2022-02-18 Partial fix CWE-416

TI-2022-08008 CVE-2022-24048 · GHSA-3p23-jfm6-493m

Stack-based buffer overflow in MariaDB

LOW 35

MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00694 Published 2022-02-18 Partial fix CWE-121

TI-2022-23281 CVE-2022-47015 · GHSA-hc8h-974x-98hr

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service.

LOW 32

MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01555 Published 2023-01-20 Partial fix CWE-476

TI-2021-14329 CVE-2021-35604 · GHSA-c9rm-w869-vhx6

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 30

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.02662 Published 2021-10-20 Partial fix

TI-2021-01844 CVE-2021-2166 · GHSA-9pgh-f42j-q89p

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

LOW 30

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.04909 Published 2021-04-22 Partial fix

TI-2021-01833 CVE-2021-2154 · GHSA-c827-7w49-pg8j

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

LOW 27

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02603 Published 2021-04-22 Partial fix

TI-2021-21431 CVE-2021-46659 · GHSA-hpgh-p2hm-xrpr

MariaDB before 10.7.2 allows an application crash because it does not recognize that…

LOW 26

MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00556 Published 2022-01-29 Partial fix

TI-2021-02042 CVE-2021-2372 · GHSA-phcf-v7xh-g74h

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 26

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.03029 Published 2021-07-20 Partial fix

TI-2021-21440 CVE-2021-46668 · GHSA-h8g7-9rx9-625q

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT…

LOW 25

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.004 Published 2022-02-01 Partial fix CWE-400

TI-2021-21439 CVE-2021-46667 · GHSA-f3hf-23j8-mwgw

MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

LOW 25

MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00425 Published 2022-02-01 Partial fix CWE-190

TI-2021-21438 CVE-2021-46666 · GHSA-qhvg-j82m-w264

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown…

LOW 25

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00391 Published 2022-02-01 Partial fix CWE-617

TI-2021-21437 CVE-2021-46665 · GHSA-mwgq-r782-4vx4

MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.

LOW 25

MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.004 Published 2022-02-01 Partial fix

TI-2021-21436 CVE-2021-46664 · GHSA-7x2j-p87r-93gf

MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.

LOW 25

MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.004 Published 2022-02-01 Partial fix CWE-476

TI-2021-21435 CVE-2021-46663 · GHSA-j6gf-pxm2-h6x5

MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.

LOW 25

MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00403 Published 2022-02-01 Partial fix

TI-2021-21434 CVE-2021-46662 · GHSA-p388-7w8m-f48h

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an…

LOW 25

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00391 Published 2022-02-01 Partial fix

TI-2021-21433 CVE-2021-46661 · GHSA-jj99-6883-93g3

MariaDB through 10.5.9 allows an application crash in find_field_in_tables and…

LOW 25

MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00403 Published 2022-02-01 Partial fix

TI-2021-21430 CVE-2021-46658 · GHSA-2vgr-c24v-3xf3

save_window_function_values in MariaDB before 10.6.3 allows an application crash because…

LOW 25

save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00387 Published 2022-01-29 Partial fix

TI-2021-21429 CVE-2021-46657 · GHSA-3qqv-wmpg-38v7

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

LOW 25

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0039 Published 2022-01-29 Partial fix

TI-2022-18290 CVE-2022-38791 · GHSA-v65w-qwp3-hm34

In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not…

LOW 24

In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00253 Published 2022-08-27 Partial fix CWE-667

TI-2022-13548 CVE-2022-31624 · GHSA-qcq9-cqmp-6vr3

MariaDB Server before 10.7 is vulnerable to Denial of Service.

LOW 24

MariaDB Server before 10.7 is vulnerable to Denial of Service.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00216 Published 2022-05-25 Partial fix CWE-667

TI-2022-13547 CVE-2022-31623 · GHSA-fqhg-58rx-5ghm

MariaDB Server before 10.7 is vulnerable to Denial of Service.

LOW 24

MariaDB Server before 10.7 is vulnerable to Denial of Service.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00232 Published 2022-05-25 Partial fix CWE-667

TI-2022-13546 CVE-2022-31622 · GHSA-p293-2w9f-jrwc

MariaDB Server before 10.7 is vulnerable to Denial of Service.

LOW 24

MariaDB Server before 10.7 is vulnerable to Denial of Service.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00228 Published 2022-05-25 Partial fix CWE-667

TI-2022-13545 CVE-2022-31621 · GHSA-vx82-3vmh-hc4q

MariaDB Server before 10.7 is vulnerable to Denial of Service.

LOW 24

MariaDB Server before 10.7 is vulnerable to Denial of Service.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00223 Published 2022-05-25 Partial fix CWE-667

TI-2022-05974 CVE-2022-21595 · GHSA-cvq4-rgf9-fp77

Vulnerability in the MySQL Server product of Oracle MySQL (component: C API).

LOW 23

Vulnerability in the MySQL Server product of Oracle MySQL (component: C API).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.01365 Published 2022-10-18 Fixed

TI-2022-05836 CVE-2022-21451 · GHSA-3crw-xq5c-jr37

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

LOW 23

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.01232 Published 2022-04-19 Partial fix