RLSA-2022:6443

See a problem?
Import Source
https://storage.googleapis.com/resf-osv-data/RLSA-2022:6443.json
JSON Data
https://api.osv.dev/v1/vulns/RLSA-2022:6443
Related
Published
2022-09-13T07:36:42Z
Modified
2023-02-02T13:45:45.700630Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Moderate: mariadb:10.3 security and bug fix update
Details

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.35), galera (25.3.35).

Security Fix(es):

  • mariadb: MariaDB through 10.5.9 allows attackers to trigger a convertconstto_int use-after-free when the BIGINT data type is used (CVE-2021-46669)

  • mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427)

  • mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048)

  • mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050)

  • mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051)

  • mariadb: CONNECT storage engine heap-based buffer overflow (CVE-2022-24052)

  • mariadb: assertion failure in Itemargs::walkarg (CVE-2022-27376)

  • mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)

  • mariadb: server crash in createtmptable::finalize (CVE-2022-27378)

  • mariadb: server crash in component argcomparator::comparereal_fixed (CVE-2022-27379)

  • mariadb: server crash at my_decimal::operator= (CVE-2022-27380)

  • mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)

  • mariadb: use-after-poison in mystrcasecmp8bit() of ctype-simple.c (CVE-2022-27383)

  • mariadb: crash via component Itemsubselect::initexprcachetracker (CVE-2022-27384)

  • mariadb: server crashes in queryarena::setquery_arena upon SELECT from view (CVE-2022-27386)

  • mariadb: assertion failures in decimalbinsize (CVE-2022-27387)

  • mariadb: assertion failure in compareorderelements (CVE-2022-27445)

  • mariadb: use-after-poison in Binarystring::freebuffer (CVE-2022-27447)

  • mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)

  • mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)

  • mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)

  • mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)

  • mariadb: use-after-poison in Binarystring::freebuffer (CVE-2022-27458)

  • mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622)

  • mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623)

  • mariadb: server crash at Itemsubselect::initexprcachetracker (CVE-2022-32083)

  • mariadb: server crash in Itemfuncin::cleanup/Item::cleanup_processor (CVE-2022-32085)

  • mariadb: server crash in Itemargs::walkargs (CVE-2022-32087)

  • mariadb: segmentation fault in Exectimetracker::getloops/Filesorttracker::report_use/filesort (CVE-2022-32088)

  • mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)

  • mariadb: MariaDB allows an application crash in findfieldintables and findorderinlist via an unused common table expression (CTE) (CVE-2021-46661)

  • mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663)

  • mariadb: MariaDB through 10.5.9 allows an application crash in subselectpostjoin_aggr for a NULL value of aggr (CVE-2021-46664)

  • mariadb: MariaDB through 10.5.9 allows a sqlparse.cc application crash because of incorrect usedtables expectations (CVE-2021-46665)

  • mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • [Tracker] Rebase to Galera 25.3.35 for MariaDB-10.3 (BZ#2107075)
References
Credits
    • Rocky Enterprise Software Foundation
    • Red Hat

Affected packages

Rocky Linux:8 / galera

Package

Name
galera
Purl
pkg:rpm/rocky-linux/galera?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:25.3.35-1.module+el8.6.0+1005+cdf19c22

Rocky Linux:8 / Judy

Package

Name
Judy
Purl
pkg:rpm/rocky-linux/Judy?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:1.0.5-18.module+el8.4.0+427+adf35707

Rocky Linux:8 / mariadb

Package

Name
mariadb
Purl
pkg:rpm/rocky-linux/mariadb?distro=rocky-linux-8&epoch=3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3:10.3.35-1.module+el8.6.0+1005+cdf19c22