Skip to content
  1. Nov 18, 2024
    • Bastien Roucariès's avatar
      Import Debian changes 10.1.48-0+deb9u5 · 3c6b2fe1
      Bastien Roucariès authored and Otto Kekäläinen's avatar Otto Kekäläinen committed 
      mariadb-10.1 (10.1.48-0+deb9u5) stretch-security; urgency=medium

  * Non-maintainer upload by the ELTS Security Team.
  * Fix CVE-2022-31621: A Denial of Service (Dos) was found.
    In extra/mariabackup/ds_xbstream.cc, when an error
    occurs (stream_ctxt->dest_file == NULL) while executing
    the method xbstream_open, the held lock is not released
    correctly, which allows local users to trigger a denial
    of service due to the deadlock.
  * Fix CVE-2022-31623: In extra/mariabackup/ds_compress.cc,
    when an error occurs (i.e., going to the err label) while executing
    the method create_worker_threads, the held lock thd->ctrl_mutex
    is not released correctly, which allows local users to trigger
    a denial of service (DoS) due to the deadlock.
  * Fix CVE-2022-31624: While executing
    the plugin/server_audit/server_audit.c method log_statement_ex,
    the held lock lock_bigbuffer is not released correctly,
    which allows local users to trigger a denial of service (DoS)
    due to the deadlock.
  * Fix CVE-2022-47015: MariaDB was affected by Denial of Service (DoS).
    It is possible for function spider_db_mbase::print_warnings to
    dereference a null pointer.
  * Fix CVE-2024-21096: A difficult to exploit
    vulnerability allows unauthenticated attacker with logon
    to the infrastructure where MariaDB Server
    executes to compromise MariaDB Server.
    Successful attacks of this vulnerability can result in
    unauthorized update, insert or delete access to some of
    MariaDB Server accessible data as well as unauthorized
    read access to a subset of MariaDB Server accessible
    data and unauthorized ability to cause a partial
    denial of service (partial DoS)
      3c6b2fe1
  3. Nov 17, 2024
    • Bastien Roucariès's avatar
      Import Debian changes 10.1.48-0+deb9u4 · 1a0016fd
      Bastien Roucariès authored and Otto Kekäläinen's avatar Otto Kekäläinen committed 
      mariadb-10.1 (10.1.48-0+deb9u4) stretch-security; urgency=medium

  * Non-maintainer upload by the ELTS Security Team.

  [Roberto C. Sánchez]

  * Fix CVE-2021-46659: an application crash existed because MariaDB does
    not recognize that SELECT_LEX::nest_level is local to each VIEW

  [Bastien Roucariès]

  * Fix CVE-2022-21427: An Easily exploitable vulnerability allowed high
    privileged attacker with network access via multiple protocols
    to compromise MariaDB Server. Successful attacks of this vulnerability
    can result in unauthorized ability to cause a hang
    or frequently repeatable crash (complete DOS). Certain UTF8 combining
    marks cause MariaDB to crash when doing Full-Text searches.
  * Fix CVE-2022-24048, CVE-2022-24051, CVE-2022-24052:
    MariaDB CONNECT Storage Engine Stack-based Buffer
    Overflow Privilege Escalation Vulnerability. This vulnerability allows
    local attackers to escalate privileges on affected installations
    of MariaDB. Authentication is required to exploit this vulnerability.
    The specific flaw exists within the processing of SQL queries.
    The issue results from the lack of proper validation of the length
    of user-supplied data prior to copying it to a fixed-length stack-based
    buffer. An attacker can leverage this vulnerability to escalate
    privileges and execute arbitrary code in the context of the
    service account.
    Concerned storage Engine were JSON, XML, MYSQL.
  * CVE-2022-24050: MariaDB CONNECT Storage Engine Use-After-Free
    Privilege Escalation Vulnerability. This vulnerability allows local
    attackers to escalate privileges on affected installations of MariaDB.
    Authentication is required to exploit this vulnerability.
    The specific flaw exists within the processing of SQL queries.
    The issue results from the lack of validating the existence of an object
    prior to performing operations on the object.
    An attacker can leverage this vulnerability to escalate privileges and
    execute arbitrary code in the context of the service account.
  * CVE-2022-27380: An issue in the component my_decimal::operator=
    of MariaDB Server was discovered to allow attackers to cause
    a Denial of Service (DoS) via specially crafted SQL statements.
  * CVE-2022-27383:  An use-after-free was found in the component
    my_strcasecmp_8bit, which is exploited via specially crafted
    SQL statements.
  * Fix CVE-2022-27384, CVE-2022-32083 An issue in the component
    Item_subselect::init_expr_cache_tracker allow attackers to cause
    a Denial of Service (DoS) via specially crafted SQL statements.
  * Fix CVE-2022-27387: a global buffer overflow in the component
    decimal_bin_size was found, which is exploited via specially
    crafted SQL statements.
  * Fix CVE-2022-27448: There is an Assertion failure via
    'node->pcur->rel_pos == BTR_PCUR_ON'. This could lead to a
    crash in multi-update and implicit grouping
  * Fix CVE-2022-31622: Fix a Denial of Service. When an error occurs
    (pthread_create returns a nonzero value) while executing the
    method create_worker_threads, the held lock is not released
    correctly, which allows local users to trigger a denial
    of service due to the deadlock
      1a0016fd
    • Bastien Roucariès's avatar
      Import Debian changes 10.1.48-0+deb9u3 · ed57557e
      Bastien Roucariès authored and Otto Kekäläinen's avatar Otto Kekäläinen committed 
      mariadb-10.1 (10.1.48-0+deb9u3) stretch-security; urgency=medium

  * Non-maintainer upload by the ELTS Security Team.
  * Use ELTS CI.
  * Fix CVE-2021-2154: An Easily exploitable vulnerability allowed
    high privileged attacker with network access via multiple
    protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result
    in unauthorized ability to cause a hang or frequently
    repeatable crash (complete DOS). The  UDF_INIT() function
    caused a crash.
  * Fix CVE-2021-2166: An Easily exploitable vulnerability allowed
    high privileged attacker with network access via multiple
    protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result
    in unauthorized ability to cause a hang or frequently
    repeatable crash (complete DOS). Plugin variables in SET
    were not correctly locked.
  * Fix CVE-2021-2194: An Easily exploitable vulnerability allowed
    high privileged attacker with network access via multiple
    protocols to compromise MySQL Server. Successful attacks of
    this vulnerability can result in unauthorized ability to
    cause a hang or frequently repeatable crash (complete DOS).
    In Full-text phrase search, MariaDB filter out row that
    do not contain all the tokens in the phrase.
    If MariaDB do not filter out doc_id that doesn't appear in all the
    token's doc_id lists then hit an assert.
  * Fix CVE-2021-2389: An Easily exploitable vulnerability allowed
    high privileged attacker with network access via multiple
    protocols to compromise MySQL Server. Successful attacks of
    this vulnerability can result in unauthorized ability to
    cause a hang or frequently repeatable crash (complete DOS).
    Server throws OOM error when we execute twitter load with SELECTs
    for UPDATE + UPDATES, and SELECT queries on tables with full-text
    index.
  * Fix CVE-2021-46657: get_sort_by_table in MariaDB allowed an
    application crash via certain subquery uses of ORDER BY.
  * Fix CVE-2021-46661: MariaDB allowed an application crash
    in find_field_in_tables and find_order_in_list
    via an unused common table expression (CTE).
  * Fix CVE-2021-46663: MariaDB allowed a ha_maria::extra application
    crash via certain SELECT statements.
  * Fix CVE-2021-46664: MariaDB crashed in sub_select_postjoin_aggr
    for a NULL value of aggr.
  * Fix CVE-2021-46665: MariaDB crashed because of
    incorrect used_tables expectations.
  * Fix CVE-2021-46666: MariaDB crashed because of mishandling
    of a pushdown from a HAVING clause to a WHERE clause.
  * Fix CVE-2021-46667: MariadDB was vulnerable due to a sql_lex.cc
    integer overflow, leading to an application crash.
  * Fix CVE-2021-46668: MariaDB crashed via certain long
    SELECT DISTINCT statements that improperly interact with
    storage-engine resource limitations for temporary data structures.
  * Fix CVE-2021-46669: MariaDB allowed attackers to trigger a
    convert_const_to_int use-after-free when the BIGINT data type is used.
      ed57557e
  5. May 02, 2021
  7. Oct 13, 2020
  9. Oct 12, 2020
  11. Jul 04, 2020
  13. Jan 30, 2020
  15. Jan 29, 2020
  17. Nov 11, 2019
  19. Aug 27, 2019
  21. Aug 24, 2019
  23. Aug 02, 2019
  25. Aug 01, 2019
  27. Jul 25, 2019
  29. May 19, 2019
  31. May 03, 2019
  33. Apr 16, 2019