Detections
Analytics

Mandriva Linux Security Advisory : mariadb (MDVSA-2014:210)

high Nessus Plugin ID 78718

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Multiple vulnerabilities has been discovered and corrected in mariadb :

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB DML FOREIGN KEYS (CVE-2014-6464).

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and eariler and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:OPTIMIZER (CVE-2014-6469).

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (CVE-2014-6507).

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (CVE-2014-6555).

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING (CVE-2014-6559).

The updated packages have been upgraded to the 5.5.40 version which is not vulnerable to these issues.

Additionally MariaDB 5.5.40 removed the bundled copy of jemalloc from the source tarball and only builds with jemalloc if a system copy of the jemalloc library is detecting during the build. This update provides the jemalloc library packages to resolve this issue.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?1ada40cc

https://bugs.mageia.org/show_bug.cgi?id=14389

http://www.nessus.org/u?7977fe89

Plugin Details

Severity: High

ID: 78718

File Name: mandriva_MDVSA-2014-210.nasl

Version: 1.5

Type: local

Published: 10/29/2014

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.3

CVSS v2

Risk Factor: High

Base Score: 8

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64jemalloc-devel, p-cpe:/a:mandriva:linux:lib64jemalloc1, p-cpe:/a:mandriva:linux:lib64mariadb-devel, p-cpe:/a:mandriva:linux:lib64mariadb-embedded-devel, p-cpe:/a:mandriva:linux:lib64mariadb-embedded18, p-cpe:/a:mandriva:linux:lib64mariadb18, p-cpe:/a:mandriva:linux:mariadb, p-cpe:/a:mandriva:linux:mariadb-bench, p-cpe:/a:mandriva:linux:mariadb-client, p-cpe:/a:mandriva:linux:mariadb-common, p-cpe:/a:mandriva:linux:mariadb-common-core, p-cpe:/a:mandriva:linux:mariadb-core, p-cpe:/a:mandriva:linux:mariadb-extra, p-cpe:/a:mandriva:linux:mariadb-feedback, p-cpe:/a:mandriva:linux:mariadb-obsolete, p-cpe:/a:mandriva:linux:mysql-mariadb, cpe:/o:mandriva:business_server:1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/28/2014

Reference Information

CVE: CVE-2014-6464, CVE-2014-6469, CVE-2014-6507, CVE-2014-6555, CVE-2014-6559

BID: 70446, 70451, 70487, 70530, 70550

MDVSA: 2014:210