openSUSE Security Update : mariadb (openSUSE-2019-327)

critical Nessus Plugin ID 122849

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for mariadb to version 10.2.22 fixes the following issues :

Security issues fixed :

- CVE-2019-2510: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198).

- CVE-2019-2537: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service (bsc#1122198).

- CVE-2018-3284: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112377)

- CVE-2018-3282: Server Storage Engines unspecified vulnerability (CPU Oct 2018) (bsc#1112432)

- CVE-2018-3277: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112391)

- CVE-2018-3251: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112397)

- CVE-2018-3200: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112404)

- CVE-2018-3185: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112384)

- CVE-2018-3174: Client programs unspecified vulnerability (CPU Oct 2018) (bsc#1112368)

- CVE-2018-3173: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112386)

- CVE-2018-3162: Fixed InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112415)

- CVE-2018-3156: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112417)

- CVE-2018-3143: InnoDB unspecified vulnerability (CPU Oct 2018) (bsc#1112421)

- CVE-2018-3066: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Options). (bsc#1101678)

- CVE-2018-3064: InnoDB unspecified vulnerability (CPU Jul 2018) (bsc#1103342)

- CVE-2018-3063: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent Server Security Privileges). (bsc#1101677)

- CVE-2018-3058: Unspecified vulnerability in the MySQL Server component of Oracle MySQL (subcomponent MyISAM).
(bsc#1101676)

- CVE-2016-9843: Big-endian out-of-bounds pointer (bsc#1013882)

Non-security issues fixed :

- Fixed an issue where mysl_install_db fails due to incorrect basedir (bsc#1127027).

- Fixed an issue where the lograte was not working (bsc#1112767).

- Backport Information Schema CHECK_CONSTRAINTS Table.

- Maximum value of table_definition_cache is now 2097152.

- InnoDB ALTER TABLE fixes.

- Galera crash recovery fixes.

- Encryption fixes.

- Remove xtrabackup dependency as MariaDB ships a build in mariabackup so xtrabackup is not needed (bsc#1122475).

- Maria DB testsuite - test main.plugin_auth failed (bsc#1111859)

- Maria DB testsuite - test encryption.second_plugin-12863 failed (bsc#1111858)

- Remove PerconaFT from the package as it has AGPL licence (bsc#1118754)

- remove PerconaFT from the package as it has AGPL licence (bsc#1118754)

- Database corruption after renaming a prefix-indexed column (bsc#1120041)

Release notes and changelog :

- https://mariadb.com/kb/en/library/mariadb-10222-release-notes

- https://mariadb.com/kb/en/library/mariadb-10222-changelog/

This update was imported from the SUSE:SLE-15:Update update project.

Solution

Update the affected mariadb packages.

Plugin Details

Severity: Critical

ID: 122849

File Name: openSUSE-2019-327.nasl

Version: 1.5

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 3/14/2019

Updated: 6/13/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2016-9843

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:15.0, p-cpe:/a:novell:opensuse:mariadb-debugsource, p-cpe:/a:novell:opensuse:mariadb-test-debuginfo, p-cpe:/a:novell:opensuse:mariadb-debuginfo, p-cpe:/a:novell:opensuse:mariadb-errormessages, p-cpe:/a:novell:opensuse:mariadb-test, p-cpe:/a:novell:opensuse:mariadb-tools-debuginfo, p-cpe:/a:novell:opensuse:mariadb-galera, p-cpe:/a:novell:opensuse:mariadb-bench, p-cpe:/a:novell:opensuse:mariadb-bench-debuginfo, p-cpe:/a:novell:opensuse:mariadb-client-debuginfo, p-cpe:/a:novell:opensuse:mariadb-tools, p-cpe:/a:novell:opensuse:mariadb-client, p-cpe:/a:novell:opensuse:mariadb, p-cpe:/a:novell:opensuse:libmysqld19, p-cpe:/a:novell:opensuse:libmysqld19-debuginfo, p-cpe:/a:novell:opensuse:libmysqld-devel

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 3/23/2019

Vulnerability Publication Date: 5/23/2017

Reference Information

CVE: CVE-2016-9843, CVE-2018-3058, CVE-2018-3060, CVE-2018-3063, CVE-2018-3064, CVE-2018-3066, CVE-2018-3143, CVE-2018-3156, CVE-2018-3162, CVE-2018-3173, CVE-2018-3174, CVE-2018-3185, CVE-2018-3200, CVE-2018-3251, CVE-2018-3277, CVE-2018-3282, CVE-2018-3284, CVE-2019-2510, CVE-2019-2537

Detections

Analytics