SUSE-SU-2022:3159-1

Опубликовано: 07 сент. 2022

Источник: suse-cvrf

Описание

Security update for mariadb

This update for mariadb fixes the following issues:

Updated to 10.6.9:
- CVE-2022-32082: Fixed a reachable assertion that would crash the server (bsc#1201162).
- CVE-2022-32089: Fixed a segmentation fault that coudl be triggered via a crafted query (bsc#1201169).
- CVE-2022-32081: Fixed a buffer overflow on instant ADD/DROP of generated column (bsc#1201161).
- CVE-2022-32091: Fixed a memory corruption issue that could be triggered via a crafted query (bsc#1201170).
- CVE-2022-32084: Fixed a segmentation fault on INSERT SELECT queries (bsc#1201164).
Additionaly, the following issues were previously fixed:
- CVE-2022-32088: Fixed a server crash when using ORDER BY with window function and UNION(bsc#1201168).
- CVE-2022-32087: Fixed a segmentation fault that could be triggered via a crafted query (bsc#1201167).
- CVE-2022-32086: Fixed a server crash on INSERT SELECT queries (bsc#1201166).
- CVE-2022-32085: Fixed a segmentation fault that could be triggered via a crafted query (bsc#1201165).
- CVE-2022-32083: Fixed a segmentation fault that could be triggered via a crafted query (bsc#1201163).

Bugfixes:

Update mysql-systemd-helper to be aware of custom group (bsc#1200105).

Список пакетов

Container suse/rmt-mariadb-client:latest

mariadb-client-10.6.9-150400.3.12.1

mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest

mariadb-10.6.9-150400.3.12.1

mariadb-client-10.6.9-150400.3.12.1

mariadb-errormessages-10.6.9-150400.3.12.1

mariadb-tools-10.6.9-150400.3.12.1

SUSE Linux Enterprise Module for Server Applications 15 SP4

libmariadbd-devel-10.6.9-150400.3.12.1

libmariadbd19-10.6.9-150400.3.12.1

mariadb-10.6.9-150400.3.12.1

mariadb-client-10.6.9-150400.3.12.1

mariadb-errormessages-10.6.9-150400.3.12.1

mariadb-tools-10.6.9-150400.3.12.1

openSUSE Leap 15.4

libmariadbd-devel-10.6.9-150400.3.12.1

libmariadbd19-10.6.9-150400.3.12.1

mariadb-10.6.9-150400.3.12.1

mariadb-bench-10.6.9-150400.3.12.1

mariadb-client-10.6.9-150400.3.12.1

mariadb-errormessages-10.6.9-150400.3.12.1

mariadb-galera-10.6.9-150400.3.12.1

mariadb-rpm-macros-10.6.9-150400.3.12.1

mariadb-test-10.6.9-150400.3.12.1

mariadb-tools-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/support/update/announcement/2022/suse-su-20223159-1/
Link for SUSE-SU-2022:3159-1
https://lists.suse.com/pipermail/sle-updates/2022-September/024950.html
E-Mail link for SUSE-SU-2022:3159-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1200105
SUSE Bug 1200105
https://bugzilla.suse.com/1201161
SUSE Bug 1201161
https://bugzilla.suse.com/1201162
SUSE Bug 1201162
https://bugzilla.suse.com/1201163
SUSE Bug 1201163
https://bugzilla.suse.com/1201164
SUSE Bug 1201164
https://bugzilla.suse.com/1201165
SUSE Bug 1201165
https://bugzilla.suse.com/1201166
SUSE Bug 1201166
https://bugzilla.suse.com/1201167
SUSE Bug 1201167
https://bugzilla.suse.com/1201168
SUSE Bug 1201168
https://bugzilla.suse.com/1201169
SUSE Bug 1201169
https://bugzilla.suse.com/1201170
SUSE Bug 1201170
https://www.suse.com/security/cve/CVE-2022-32081/
SUSE CVE CVE-2022-32081 page
https://www.suse.com/security/cve/CVE-2022-32082/
SUSE CVE CVE-2022-32082 page
https://www.suse.com/security/cve/CVE-2022-32083/
SUSE CVE CVE-2022-32083 page
https://www.suse.com/security/cve/CVE-2022-32084/
SUSE CVE CVE-2022-32084 page
https://www.suse.com/security/cve/CVE-2022-32085/
SUSE CVE CVE-2022-32085 page
https://www.suse.com/security/cve/CVE-2022-32086/
SUSE CVE CVE-2022-32086 page

Описание

MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32081.html
CVE-2022-32081
https://bugzilla.suse.com/1201161
SUSE Bug 1201161

Описание

MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32082.html
CVE-2022-32082
https://bugzilla.suse.com/1201162
SUSE Bug 1201162

Описание

MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32083.html
CVE-2022-32083
https://bugzilla.suse.com/1201163
SUSE Bug 1201163

Описание

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32084.html
CVE-2022-32084
https://bugzilla.suse.com/1201164
SUSE Bug 1201164

Описание

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32085.html
CVE-2022-32085
https://bugzilla.suse.com/1201165
SUSE Bug 1201165

Описание

MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32086.html
CVE-2022-32086
https://bugzilla.suse.com/1201166
SUSE Bug 1201166

Описание

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32087.html
CVE-2022-32087
https://bugzilla.suse.com/1201167
SUSE Bug 1201167

Описание

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32088.html
CVE-2022-32088
https://bugzilla.suse.com/1201168
SUSE Bug 1201168

Описание

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32089.html
CVE-2022-32089
https://bugzilla.suse.com/1201169
SUSE Bug 1201169

Описание

MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.

Затронутые продукты

Container suse/rmt-mariadb-client:latest:mariadb-client-10.6.9-150400.3.12.1

Container suse/rmt-mariadb-client:latest:mariadb-errormessages-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-10.6.9-150400.3.12.1

Container suse/rmt-mariadb:latest:mariadb-client-10.6.9-150400.3.12.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-32091.html
CVE-2022-32091
https://bugzilla.suse.com/1201170
SUSE Bug 1201170

SUSE-SU-2022:3159-1

Описание

Список пакетов

Container suse/rmt-mariadb-client:latest

Container suse/rmt-mariadb:latest

SUSE Linux Enterprise Module for Server Applications 15 SP4

openSUSE Leap 15.4

Ссылки

Уязвимость: CVE-2022-32081

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-32082

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-32083

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-32084

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-32085

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-32086

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-32087

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-32088

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-32089

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2022-32091

Описание

Затронутые продукты

Ссылки