MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements.

The following CVEs have been fixed :

  - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815,     CVE-2015-4826, CVE-2015-4830, CVE-2015-4836,     CVE-2015-4858, CVE-2015-4861, CVE-2015-4870,     CVE-2015-4913, CVE-2015-4792

  - Fix information leak via mysql-systemd-helper script.
    (CVE-2015-5969, bsc#957174)

For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents :

- https://kb.askmonty.org/en/mariadb-10022-release-notes/

- https://kb.askmonty.org/en/mariadb-10022-changelog/

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The version of MariaDB installed on the remote host is prior to 10.1.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.1.8 advisory.

  - Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote     authenticated users to affect availability via vectors related to Server : DML, a different vulnerability     than CVE-2015-4858. (CVE-2015-4913)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote     authenticated users to affect availability via vectors related to DML, a different vulnerability than     CVE-2015-4913. (CVE-2015-4858)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local     users to affect confidentiality, integrity, and availability via unknown vectors related to Client     programs. (CVE-2015-4819)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server : Partition, a different     vulnerability than CVE-2015-4802. (CVE-2015-4792)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server : Partition, a different     vulnerability than CVE-2015-4792. (CVE-2015-4802)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.27. It is, therefore, potentially affected by the following vulnerabilities :

  - A certificate validation bypass vulnerability exists in     the Security:Encryption subcomponent due to a flaw in     the X509_verify_cert() function in x509_vfy.c that is     triggered when locating alternate certificate chains     when the first attempt to build such a chain fails. A     remote attacker can exploit this, by using a valid leaf     certificate as a certificate authority (CA), to issue     invalid certificates that will bypass authentication.
    (CVE-2015-1793)

  - An unspecified flaw exists in the Client Programs     subcomponent. A local attacker can exploit this to gain     elevated privileges. (CVE-2015-4819)

  - An unspecified flaw exists in the Types subcomponent.
    An authenticated, remote attacker can exploit this to     gain access to sensitive information. (CVE-2015-4826)

  - An unspecified flaws exist in the Security:Privileges     subcomponent. An authenticated, remote attacker can     exploit these to impact integrity. (CVE-2015-4830,     CVE-2015-4864)

  - An unspecified flaw exists in the DLM subcomponent.
    An authenticated, remote attacker can exploit this to     impact integrity. (CVE-2015-4879)

  - An unspecified flaw exists in the Server Security     Encryption subcomponent that allows an authenticated,     remote attacker to disclose sensitive information.
    (CVE-2015-7744)

Additionally, unspecified denial of service vulnerabilities can also exist in the following MySQL subcomponents :

  - DDL (CVE-2015-4815)

  - DML (CVE-2015-4858, CVE-2015-4862, CVE-2015-4905,     CVE-2015-4913)

  - InnoDB (CVE-2015-4861, CVE-2015-4866, CVE-2015-4895)

  - libmysqld (CVE-2015-4904)

  - Memcached (CVE-2015-4910)

  - Optimizer (CVE-2015-4800)

  - Parser (CVE-2015-4870)

  - Partition (CVE-2015-4792, CVE-2015-4802, CVE-2015-4833)

  - Query (CVE-2015-4807)

  - Replication (CVE-2015-4890)

  - Security : Firewall (CVE-2015-4766)

  - Server : General (CVE-2016-0605)

  - Security : Privileges (CVE-2015-4791)

  - SP (CVE-2015-4836)

  - Types (CVE-2015-4730)

MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements.

The following CVEs have been fixed :

  - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815,     CVE-2015-4826, CVE-2015-4830, CVE-2015-4836,     CVE-2015-4858, CVE-2015-4861, CVE-2015-4870,     CVE-2015-4913, CVE-2015-4792

  - 10.0.21: CVE-2015-4816, CVE-2015-4819, CVE-2015-4879,     CVE-2015-4895

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
88615	openSUSE Security Update : mariadb (openSUSE-2016-164)	Nessus	SuSE Local Security Checks	2016/2/8	2021/1/19	medium
167902	MariaDB 10.1.0 < 10.1.8 Multiple Vulnerabilities	Nessus	Databases	2022/11/18	2026/1/29	medium
86547	MySQL 5.6.x < 5.6.27 Multiple Vulnerabilities	Nessus	Databases	2015/10/22	2018/11/15	high
87964	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0121-1)	Nessus	SuSE Local Security Checks	2016/1/18	2021/1/6	high

偵測

搜尋 Plugin

medium

medium

high

high