Advisories ยป MGASA-2018-0259

Updated mariadb packages fix security vulnerabilities

Publication date: 29 May 2018
Modification date: 29 May 2018
Type: security
Affected Mageia releases : 5
CVE: CVE-2018-2755 , CVE-2018-2761 , CVE-2018-2766 , CVE-2018-2771 , CVE-2018-2781 , CVE-2018-2782 , CVE-2018-2784 , CVE-2018-2787 , CVE-2018-2813 , CVE-2018-2817 , CVE-2018-2819

Description

Updated mariadb packages fix security vulnerabilities:

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
Server: Replication). Difficult to exploit vulnerability allows
unauthenticated attacker with logon to the infrastructure where MariaDB
Server executes to compromise MariaDB Server. Successful attacks require
human interaction from a person other than the attacker and while the
vulnerability is in MariaDB Server, attacks may significantly impact
additional products. Successful attacks of this vulnerability can result
in takeover of MariaDB Server (CVE-2018-2755).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
Client programs). Difficult to exploit vulnerability allows unauthenticated
attacker with network access via multiple protocols to compromise MariaDB
Server. Successful attacks of this vulnerability can result in unauthorized
ability to cause a hang or frequently repeatable crash (complete DOS) of
MariaDB Server (CVE-2018-2761).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
InnoDB). Easily exploitable vulnerability allows high privileged attacker
with network access via multiple protocols to compromise MariaDB Server.
Successful attacks of this vulnerability can result in unauthorized ability
to cause a hang or frequently repeatable crash (complete DOS) of MariaDB
Server (CVE-2018-2766).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
Server: Locking). Difficult to exploit vulnerability allows high privileged
attacker with network access via multiple protocols to compromise MariaDB
Server. Successful attacks of this vulnerability can result in unauthorized
ability to cause a hang or frequently repeatable crash (complete DOS) of
MariaDB Server (CVE-2018-2771).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
Server: Optimizer). Easily exploitable vulnerability allows high privileged
attacker with network access via multiple protocols to compromise MariaDB
Server. Successful attacks of this vulnerability can result in unauthorized
ability to cause a hang or frequently repeatable crash (complete DOS) of
MariaDB Server (CVE-2018-2781).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
InnoDB). Easily exploitable vulnerability allows low privileged attacker
with network access via multiple protocols to compromise MariaDB Server.
Successful attacks of this vulnerability can result in unauthorized ability
to cause a hang or frequently repeatable crash (complete DOS) of MariaDB
Server (CVE-2018-2782).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
InnoDB). Easily exploitable vulnerability allows low privileged attacker
with network access via multiple protocols to compromise MariaDB Server.
Successful attacks of this vulnerability can result in unauthorized ability
to cause a hang or frequently repeatable crash (complete DOS) of MariaDB
Server (CVE-2018-2784).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
InnoDB). Easily exploitable vulnerability allows high privileged attacker
with network access via multiple protocols to compromise MariaDB Server.
Successful attacks of this vulnerability can result in unauthorized ability
to cause a hang or frequently repeatable crash (complete DOS) of MariaDB
Server as well as unauthorized update, insert or delete access to some of
MariaDB Server accessible data (CVE-2018-2787).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
Server: DDL). Easily exploitable vulnerability allows low privileged
attacker with network access via multiple protocols to compromise MariaDB
Server. Successful attacks of this vulnerability can result in unauthorized
read access to a subset of MariaDB Server accessible data (CVE-2018-2813).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
Server: DDL). Easily exploitable vulnerability allows low privileged
attacker with network access via multiple protocols to compromise MariaDB
Server. Successful attacks of this vulnerability can result in unauthorized
ability to cause a hang or frequently repeatable crash (complete DOS) of
MariaDB Server (CVE-2018-2817).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent:
InnoDB). Easily exploitable vulnerability allows low privileged attacker
with network access via multiple protocols to compromise MariaDB Server.
Successful attacks of this vulnerability can result in unauthorized ability
to cause a hang or frequently repeatable crash (complete DOS) of MariaDB
Server (CVE-2018-2819).

References

SRPMS

5/core