Описание
Security update for mariadb
This update for mariadb fixes the following issues:
- CVE-2026-3494: audit plugin comment handling bypass (bsc#1259176).
- CVE-2026-34303: mysql: optimizer unspecified vulnerability (bsc#1266435).
- CVE-2026-44168: wsrep SST unsafe parameter handling on the donor side (bsc#1266442).
- CVE-2026-44170: argument injection in CONNECT REST Xcurl on Windows via unsanitized URL (bsc#1266440).
- CVE-2026-44171: path traversal in mbstream (bsc#1266439).
- CVE-2026-44172: mysql_real_escape_string() incorrectly handled big5 (bsc#1266438).
- CVE-2026-44173: FILE privilege was not checked for subqueries in the FROM clause (bsc#1266437).
- CVE-2026-48163: wsrep SST unsafe parameter handling on the donor side (bsc#1266815).
- CVE-2026-48165: unsafe usage of
wsrep_sst_receive_addressvalues on the joiner side (bsc#1266814). - CVE-2026-49261: unsafe parameter handling in
wsrep_notify_cmd(bsc#1267542).
Changes for mariadb:
- Update to 10.11.18: https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18 https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.18
- Update to 10.11.17: https://mariadb.com/docs/release-notes/community-server/10.11/10.11.17 https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.17 https://mariadb.com/docs/release-notes/community-server/10.11/10.11.16 https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.16
Список пакетов
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:2284-1
- E-Mail link for SUSE-SU-2026:2284-1
- SUSE Security Ratings
- SUSE Bug 1259176
- SUSE Bug 1266435
- SUSE Bug 1266437
- SUSE Bug 1266438
- SUSE Bug 1266439
- SUSE Bug 1266440
- SUSE Bug 1266442
- SUSE Bug 1266814
- SUSE Bug 1266815
- SUSE Bug 1267542
- SUSE CVE CVE-2026-34303 page
- SUSE CVE CVE-2026-3494 page
- SUSE CVE CVE-2026-44168 page
- SUSE CVE CVE-2026-44170 page
- SUSE CVE CVE-2026-44171 page
- SUSE CVE CVE-2026-44172 page
- SUSE CVE CVE-2026-44173 page
Описание
unknown
Затронутые продукты
Ссылки
- CVE-2026-34303
- SUSE Bug 1266435
Описание
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (-) or hash (#) style comments, the statement is not logged.
Затронутые продукты
Ссылки
- CVE-2026-3494
- SUSE Bug 1259176
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-44168
- SUSE Bug 1266442
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-44170
- SUSE Bug 1266440
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-44171
- SUSE Bug 1266439
Описание
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
Затронутые продукты
Ссылки
- CVE-2026-44172
- SUSE Bug 1266438
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-44173
- SUSE Bug 1266437
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-48163
- SUSE Bug 1266815
Описание
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Затронутые продукты
Ссылки
- CVE-2026-48165
- SUSE Bug 1266814
Описание
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
Затронутые продукты
Ссылки
- CVE-2026-49261
- SUSE Bug 1267542