The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and the mariadb package before 10.0.22-2.21.2 in openSUSE 13.2 and before 10.0.22-3.1 in SUSE Linux Enterprise (SLE) 12.1 and openSUSE Leap 42.1 allows local users to discover database credentials by listing a process and its arguments.

This update for mariadb fixes the following security issue :

  - CVE-2015-5969: Fixed information leak via     mysql-systemd-helper script. (boo#957174)

This update to MySQL 5.6.28 fixes the following issues (bsc#962779) :

  - CVE-2015-7744: Lack of verification against faults     associated with the Chinese Remainder Theorem (CRT)     process when allowing ephemeral key exchange without low     memory optimizations on a server, which makes it easier     for remote attackers to obtain private RSA keys by     capturing TLS handshakes, aka a Lenstra attack.

  - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL     5.5.31 and earlier and 5.6.11 and earlier allows remote     authenticated users to affect availability via unknown     vectors related to Optimizer. 

  - CVE-2016-0503: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via vectors related to DML,     a different vulnerability than CVE-2016-0504. 

  - CVE-2016-0504: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via vectors related to DML,     a different vulnerability than CVE-2016-0503. 

  - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to Options. 

  - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     local users to affect confidentiality, integrity, and     availability via unknown vectors related to Client. 

  - CVE-2016-0594: Unspecified vulnerability in Oracle MySQL     5.6.21 and earlier allows remote authenticated users to     affect availability via vectors related to DML. 

  - CVE-2016-0595: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier allows remote authenticated users to     affect availability via vectors related to DML. 

  - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier and 5.6.27 and earlier allows remote     authenticated users to affect availability via vectors     related to DML. 

  - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to Optimizer. 

  - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     vectors related to DML. 

  - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to InnoDB. 

  - CVE-2016-0605: Unspecified vulnerability in Oracle MySQL     5.6.26 and earlier allows remote authenticated users to     affect availability via unknown vectors. 

  - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect integrity via     unknown vectors related to encryption. 

  - CVE-2016-0607: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via unknown vectors related     to replication. 

  - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     vectors related to UDF. 

  - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL     5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows     remote authenticated users to affect availability via     unknown vectors related to privileges. 

  - CVE-2016-0610: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier allows remote authenticated users to     affect availability via unknown vectors related to     InnoDB. 

  - CVE-2016-0611: Unspecified vulnerability in Oracle MySQL     5.6.27 and earlier and 5.7.9 allows remote authenticated     users to affect availability via unknown vectors related     to Optimizer.

  - CVE-2015-5969: Fixed information leak via     mysql-systemd-helper script. (bsc#957174)

  - bsc#959724: Possible buffer overflow from incorrect use     of strcpy() and sprintf()

MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements.

The following CVEs have been fixed :

  - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815,     CVE-2015-4826, CVE-2015-4830, CVE-2015-4836,     CVE-2015-4858, CVE-2015-4861, CVE-2015-4870,     CVE-2015-4913, CVE-2015-4792

  - Fix information leak via mysql-systemd-helper script.
    (CVE-2015-5969, bsc#957174)

For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents :

- https://kb.askmonty.org/en/mariadb-10022-release-notes/

- https://kb.askmonty.org/en/mariadb-10022-changelog/

This update was imported from the SUSE:SLE-12-SP1:Update update project.

MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements.

The following CVEs have been fixed :

  - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815,     CVE-2015-4826, CVE-2015-4830, CVE-2015-4836,     CVE-2015-4858, CVE-2015-4861, CVE-2015-4870,     CVE-2015-4913, CVE-2015-4792

  - Fix information leak via mysql-systemd-helper script.
    (CVE-2015-5969, bsc#957174)

For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents :

- https://kb.askmonty.org/en/mariadb-10022-release-notes/

- https://kb.askmonty.org/en/mariadb-10022-changelog/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
88635	openSUSE Security Update : mariadb (openSUSE-2016-171)	Nessus	SuSE Local Security Checks	medium
88616	openSUSE Security Update : MySQL (openSUSE-2016-165)	Nessus	SuSE Local Security Checks	medium
88615	openSUSE Security Update : mariadb (openSUSE-2016-164)	Nessus	SuSE Local Security Checks	medium
88515	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0296-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2015-5969

medium

Tenable Plugins

medium

medium

medium

medium