MariaDB 已更新到版本 10.0.22，提供了许多安全问题的补丁和其他改善。

已修复了以下 CVE：

- 10.0.22：CVE-2015-4802、CVE-2015-4807、CVE-2015-4815、CVE-2015-4826、CVE-2015-4830、CVE-2015-4836、CVE-2015-4858、CVE-2015-4861、CVE-2015-4870、CVE-2015-4913、CVE-2015-4792

- 10.0.21：CVE-2015-4816、CVE-2015-4819、CVE-2015-4879、CVE-2015-4895

以下非安全问题已修复：

- 修复 rc.mysql-multi 脚本，以在重新启动后正确启动实例。(bsc#934401)

- 修复 rc.mysql-multi 脚本，以在崩溃后重新启动。
 (bsc#937258)

如需完整的变更列表，请参阅上游发行说明与变更日志文档：

- https://kb.askmonty.org/en/mariadb-10022-release-notes/

- https://kb.askmonty.org/en/mariadb-10021-release-notes/

- https://kb.askmonty.org/en/mariadb-10022-changelog/

- https://kb.askmonty.org/en/mariadb-10021-changelog/

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

已在 MySQL 中发现多个安全问题，此更新包含新的上游 MySQL 版本以修复这些问题。

MySQL 在 Ubuntu 12.04 LTS 和 Ubuntu 14.04 LTS 中已更新到 5.5.46。Ubuntu 15.04 和 Ubuntu 15.10 已更新到 MySQL 5.6.27。

除了安全补丁，这些更新后的程序包还包含缺陷补丁、新功能，并且可能包含不兼容的更改。

如需详细信息，请参阅下列网页：
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-45.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-26.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-27.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.h tml。

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

这是 10.0.23 版的更新，也提供以下项目的所有补丁：CVE-2015-4792、CVE-2015-4802、CVE-2015-4807、CVE-2015-4815、CVE-2015-4816、CVE-2015-4819、CVE-2015-4826、CVE-2015-4830、CVE-2015-4836、CVE-2015-4858、CVE-2015-4861、CVE-2015-4870、CVE-2015-4879、CVE-2015-4895、CVE-2015-4913、CVE-2015-7744、CVE-2016-0502、CVE-2016-0503、CVE-2016-0504、CVE-2016-0505、CVE-2016-0546、CVE-2016-0594、CVE-2016-0595、CVE-2016-0596、CVE-2016-0597、CVE-2016-0598、CVE-2016-0599、CVE-2016-0600、CVE-2016-0601、CVE-2016-0605、CVE-2016-0606、CVE-2016-0607、CVE-2016-0608、CVE-2016-0609、CVE-2016-0610、CVE-2016-0611、CVE-2016-0616（其中某些已在前版更新中修复）。

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

The version of MySQL installed on the remote host is version 5.5.x prior to 5.5.46 or 5.6.x prior to 5.6.27 and is affected by vulnerabilities in the following components :

- :

 - Client Programs
 - Data Definition Language
 - Data Manipulation Language
 - InnoDB
 - Option
 - Partition
 - Query Cache
 - Security:Privileges
 - Server Parser
 - Server Partition
 - Stored Procedures
 - Types

MariaDB is a community-developed fork of the MySQL relational database. The version of MariaDB installed on the remote host is earlier than 10.0.22, and is therefore affected by the following denial of service vulnerabilities :

 - Multiple denial ofservice vulnerabilities exist due to multiple unspecified flaws in the 'Server : Partition'subcomponent.  An authenticated, remote attacker can exploit these flaws to affect availability. (CVE-2015-4792, CVE-2015-4802)
 - A denial of service vulnerability exists due to an unspecified flaw in the Query Cache subcomponent.  An authenticated, remote attacker can exploit this to affect availability. (CVE-2015-4807)
 - A denial of service vulnerability exists due to an unspecified flaw in the DDL subcomponent.  An authenticated, remote attacker can exploit this to affect availability. (CVE-2015-4815)
 - An information disclosure vulnerability exists due to an unspecified flaw in the Types subcomponent.  An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2015-4826)
 - An unspecified vulnerability exists due to an unspecified flaw in the 'Security : Privileges' subcomponent.  An authenticated, remote attacker can exploit this to affect integrity. (CVE-2015-4830)
 - A denial of service vulnerability exists due to an unspecified flaw in the SP subcomponent.  An authenticated, remote attacker can exploit this to affect availability. (CVE-2015-4836)
 - Multiple denial of service vulnerabilities exist due to multiple unspecified flaws in the DML subcomponent.  An authenticated, remote attacker can exploit these flaws to affect availability. (CVE-2015-4858, CVE-2015-4913)
 - A denial of service vulnerability exists due to an unspecified flaw in the InnoDB subcomponent.  An authenticated, remote attacker can exploit this to affect availability. (CVE-2015-4861)
 - A denial of service vulnerability exists due to an unspecified flaw in the 'Server : Parser' subcomponent.  An authenticated, remote attacker can exploit this to affect availability. (CVE-2015-4870)
 - A denial of service vulnerability exists due to a flaw in the 'convert_kill_to_deadlock_error()' function that is triggered when handling rollbacks.  An authenticated, remote attacker can exploit this, via a specially crafted query, to cause the database to crash.
 - A denial of service vulnerability exists due to a flaw in the 'no_rows_in_result()' function that is triggered when handling logical conditions.  An authenticated, remote attacker can exploit this, via a specially crafted query, to cause the database to crash.

ID	名稱	產品	系列	已發布	已更新	嚴重性
87964	SUSE SLED12 / SLES12 安全更新：mariadb (SUSE-SU-2016:0121-1)	Nessus	SuSE Local Security Checks	2016/1/18	2021/1/6	high
86617	Ubuntu 14.04 LTS：MySQL 漏洞 (USN-2781-1)	Nessus	Ubuntu Local Security Checks	2015/10/27	2023/10/20	medium
89628	Fedora 23：mariadb-10.0.23-1.fc23 (2016-e30164d0a2)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	high
9252	Oracle MySQL 5.5.x < 5.5.46 / 5.6.x < 5.6.27 Multiple Vulnerabilities	Nessus Network Monitor	Database	2016/4/15	2019/3/6	high
9284	MariaDB Server 10.0.x < 10.0.22 Multiple DoS Vulnerabilities	Nessus Network Monitor	Database	2016/5/13	2019/3/6	medium

偵測

搜尋 Plugin

high

medium

high

high

medium