Detections
Analytics

Debian dla-4208 : libmariadb-dev - security update

medium Nessus Plugin ID 237758

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4208 advisory.

 [email protected] Subject: [SECURITY] [DLA 4208-1] mariadb-10.5 security update

 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4208-1 [email protected] https://www.debian.org/lts/security/ Otto Kekalainen June 04, 2025 https://wiki.debian.org/LTS
 - -------------------------------------------------------------------------

 Package : mariadb-10.5 Version : 1:10.5.29-0+deb11u1 CVE ID : CVE-2025-30693 CVE-2025-30722 Debian Bug : 1099515 1105976

 Vulnerabilities was discovered in MariaDB, a SQL database server compatible with MySQL.

 CVE-2025-30693

 Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MariaDB Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DoS) of MariaDB Server as well as unauthorized update, insert or delete access to some of MariaDB Server accessible data.

 CVE-2025-30722

 Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MariaDB Client. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MariaDB Client accessible data as well as unauthorized update, insert or delete access to some of MariaDB Client accessible data


 For Debian 11 bullseye, these problems have been fixed in version 1:10.5.29-0+deb11u1.


 This update also includes a NEWS entry about CVE-2025-30693:

 Fix of CVE-2025-30693, need to changes data format of innoDB format particularly variable-length encoding. Fix replace mach_write_compressed() with mach_u64_write_much_compressed(), which produces an identical encoding for 32-bit unsigned values.
 Any 64-bit unsigned integer that does not fit in 32 bits would be encoded as the octet 0xff followed by two the variable-length encoded 32-bit halves of the integer.

 This scheme is not backward compatible with older format, and may break external tools, particularly if tools read indexes on virtual columns in InnoDB undo log records.


 Additionally, the updates also includes bugfixes through the 10.5 maintenance branch, as detailed at: https://mariadb.com/kb/en/mariadb-10-5-29-release-notes/

 We recommend that you upgrade your mariadb-10.5 packages.

 For the detailed security status of mariadb-10.5 please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/mariadb-10.5

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libmariadb-dev packages.

See Also

http://www.nessus.org/u?a808a9b2

https://security-tracker.debian.org/tracker/CVE-2025-30693

https://security-tracker.debian.org/tracker/CVE-2025-30722

https://packages.debian.org/source/bullseye/mariadb-10.5

Plugin Details

Severity: Medium

ID: 237758

File Name: debian_DLA-4208.nasl

Version: 1.1

Type: local

Agent: unix

Published: 6/4/2025

Updated: 6/4/2025

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:M/C:N/I:P/A:C

CVSS Score Source: CVE-2025-30693

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:mariadb-client, cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:mariadb-client-core-10.5, p-cpe:/a:debian:debian_linux:mariadb-plugin-connect, p-cpe:/a:debian:debian_linux:mariadb-plugin-mroonga, p-cpe:/a:debian:debian_linux:libmariadbd19, p-cpe:/a:debian:debian_linux:mariadb-test-data, p-cpe:/a:debian:debian_linux:mariadb-common, p-cpe:/a:debian:debian_linux:mariadb-plugin-oqgraph, p-cpe:/a:debian:debian_linux:mariadb-plugin-s3, p-cpe:/a:debian:debian_linux:libmariadb3, p-cpe:/a:debian:debian_linux:mariadb-plugin-cracklib-password-check, p-cpe:/a:debian:debian_linux:mariadb-server-core-10.5, p-cpe:/a:debian:debian_linux:mariadb-backup, p-cpe:/a:debian:debian_linux:mariadb-plugin-spider, p-cpe:/a:debian:debian_linux:libmariadb-dev, p-cpe:/a:debian:debian_linux:mariadb-server, p-cpe:/a:debian:debian_linux:mariadb-plugin-rocksdb, p-cpe:/a:debian:debian_linux:libmariadbd-dev, p-cpe:/a:debian:debian_linux:libmariadb-dev-compat, p-cpe:/a:debian:debian_linux:mariadb-plugin-gssapi-client, p-cpe:/a:debian:debian_linux:mariadb-server-10.5, p-cpe:/a:debian:debian_linux:mariadb-test, p-cpe:/a:debian:debian_linux:mariadb-client-10.5, p-cpe:/a:debian:debian_linux:mariadb-plugin-gssapi-server

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 6/4/2025

Vulnerability Publication Date: 4/15/2025

Reference Information

CVE: CVE-2025-30693, CVE-2025-30722