SUSE-SU-2022:3391-1: important: Security update for mariadb

SUSE 5149 Published by

A mariadb security update has been released for SUSE Linux Enterprise and openSUSE Leap 15.3.



SUSE-SU-2022:3391-1: important: Security update for mariadb


SUSE Security Update: Security update for mariadb
______________________________________________________________________________

Announcement ID: SUSE-SU-2022:3391-1
Rating: important
References: #1200105 #1201161 #1201162 #1201163 #1201164 #1201165 #1201166 #1201167 #1201168 #1201169 #1201170 #1202863
Cross-References: CVE-2022-32081 CVE-2022-32082 CVE-2022-32083 CVE-2022-32084 CVE-2022-32085 CVE-2022-32086 CVE-2022-32087 CVE-2022-32088 CVE-2022-32089 CVE-2022-32091 CVE-2022-38791
CVSS scores:
CVE-2022-32081 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32081 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32082 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32082 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32083 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32083 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32084 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32084 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32085 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32085 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32086 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32086 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32087 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32087 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32088 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32088 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32089 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32089 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32091 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-32091 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-38791 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2022-38791 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:
SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3
SUSE Linux Enterprise Module for Server Applications 15-SP3
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP3SUSE Linux Enterprise Storage 7.1
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.2
SUSE Manager Server 4.2
openSUSE Leap 15.3
______________________________________________________________________________

An update that solves 11 vulnerabilities and has one errata is now available.

Description:

This update for mariadb fixes the following issues:

Update to 10.5.17:

- CVE-2022-32082: Fixed assertion failure at table->get_ref_count() == 0 in dict0dict.cc (bsc#1201162).
- CVE-2022-32089: Fixed segmentation fault via the component st_select_lex_unit::exclude_level (bsc#1201169).
- CVE-2022-32081: Fixed use-after-poison in prepare_inplace_add_virtual at
/storage/innobase/handler/handler0alter.cc (bsc#1201161). - CVE-2022-32091: Fixed use-after-poison in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc (bsc#1201170).
- CVE-2022-32084: Fixed segmentation fault via the component sub_select (bsc#1201164).
- CVE-2022-38791: Fixed deadlock in compress_write in
extra/mariabackup/ds_compress.cc (bsc#1202863).

- CVE-2022-32088: Fixed segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (bsc#1201168).
- CVE-2022-32087: Fixed segmentation fault via the component Item_args::walk_args (bsc#1201167).
- CVE-2022-32086: Fixed segmentation fault via the component Item_field::fix_outer_field (bsc#1201166).
- CVE-2022-32085: Fixed segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor (bsc#1201165). - CVE-2022-32083: Fixed segmentation fault via the component Item_subselect::init_expr_cache_tracker (bsc#1201163).
Bugfixes:

- Fixed mysql-systemd-helper being unaware of custom group (bsc#1200105).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:
- openSUSE Leap 15.3:

zypper in -t patch openSUSE-SLE-15.3-2022-3391=1

- SUSE Linux Enterprise Module for Server Applications 15-SP3:
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3391=1

- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3:
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-3391=1


Package List:

- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):

libmariadbd-devel-10.5.17-150300.3.21.1
libmariadbd19-10.5.17-150300.3.21.1
libmariadbd19-debuginfo-10.5.17-150300.3.21.1
mariadb-10.5.17-150300.3.21.1
mariadb-bench-10.5.17-150300.3.21.1
mariadb-bench-debuginfo-10.5.17-150300.3.21.1
mariadb-client-10.5.17-150300.3.21.1
mariadb-client-debuginfo-10.5.17-150300.3.21.1
mariadb-debuginfo-10.5.17-150300.3.21.1
mariadb-debugsource-10.5.17-150300.3.21.1
mariadb-rpm-macros-10.5.17-150300.3.21.1
mariadb-test-10.5.17-150300.3.21.1
mariadb-test-debuginfo-10.5.17-150300.3.21.1
mariadb-tools-10.5.17-150300.3.21.1
mariadb-tools-debuginfo-10.5.17-150300.3.21.1

- openSUSE Leap 15.3 (noarch):

mariadb-errormessages-10.5.17-150300.3.21.1

- SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64):

libmariadbd-devel-10.5.17-150300.3.21.1
libmariadbd19-10.5.17-150300.3.21.1
libmariadbd19-debuginfo-10.5.17-150300.3.21.1
mariadb-10.5.17-150300.3.21.1
mariadb-client-10.5.17-150300.3.21.1
mariadb-client-debuginfo-10.5.17-150300.3.21.1
mariadb-debuginfo-10.5.17-150300.3.21.1
mariadb-debugsource-10.5.17-150300.3.21.1
mariadb-tools-10.5.17-150300.3.21.1
mariadb-tools-debuginfo-10.5.17-150300.3.21.1

- SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch):
mariadb-errormessages-10.5.17-150300.3.21.1

- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64):

mariadb-galera-10.5.17-150300.3.21.1

References:

  https://www.suse.com/security/cve/CVE-2022-32081.html
  https://www.suse.com/security/cve/CVE-2022-32082.html
  https://www.suse.com/security/cve/CVE-2022-32083.html
  https://www.suse.com/security/cve/CVE-2022-32084.html
  https://www.suse.com/security/cve/CVE-2022-32085.html
  https://www.suse.com/security/cve/CVE-2022-32086.html
  https://www.suse.com/security/cve/CVE-2022-32087.html
  https://www.suse.com/security/cve/CVE-2022-32088.html
  https://www.suse.com/security/cve/CVE-2022-32089.html
  https://www.suse.com/security/cve/CVE-2022-32091.html
  https://www.suse.com/security/cve/CVE-2022-38791.html
  https://bugzilla.suse.com/1200105
  https://bugzilla.suse.com/1201161
  https://bugzilla.suse.com/1201162
  https://bugzilla.suse.com/1201163
  https://bugzilla.suse.com/1201164
  https://bugzilla.suse.com/1201165
  https://bugzilla.suse.com/1201166
  https://bugzilla.suse.com/1201167
  https://bugzilla.suse.com/1201168
  https://bugzilla.suse.com/1201169
  https://bugzilla.suse.com/1201170
  https://bugzilla.suse.com/1202863



USN-5638-1: Expat vulnerability

DLA 3121-1: firefox-esr security update

Windows

Linux

macOS

Community

  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...
  • StephanX
    Hi friends, i am new in the Linux universe but i try to ...
  • Philipp
    I would try the XanMod kernel: https://xanmod.org  I ...