Mandriva Linux Security Advisory : mariadb (MDVSA-2014:210)

High Nessus Plugin ID 78718

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Multiple vulnerabilities has been discovered and corrected in mariadb :

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB DML FOREIGN KEYS (CVE-2014-6464).

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and eariler and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:OPTIMIZER (CVE-2014-6469).

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (CVE-2014-6507).

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML (CVE-2014-6555).

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING (CVE-2014-6559).

The updated packages have been upgraded to the 5.5.40 version which is not vulnerable to these issues.

Additionally MariaDB 5.5.40 removed the bundled copy of jemalloc from the source tarball and only builds with jemalloc if a system copy of the jemalloc library is detecting during the build. This update provides the jemalloc library packages to resolve this issue.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?1ada40cc

https://bugs.mageia.org/show_bug.cgi?id=14389

http://www.nessus.org/u?7977fe89

Plugin Details

Severity: High

ID: 78718

File Name: mandriva_MDVSA-2014-210.nasl

Version: 1.4

Type: local

Published: 2014/10/29

Updated: 2019/08/02

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 8

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64jemalloc-devel, p-cpe:/a:mandriva:linux:lib64jemalloc1, p-cpe:/a:mandriva:linux:lib64mariadb-devel, p-cpe:/a:mandriva:linux:lib64mariadb-embedded-devel, p-cpe:/a:mandriva:linux:lib64mariadb-embedded18, p-cpe:/a:mandriva:linux:lib64mariadb18, p-cpe:/a:mandriva:linux:mariadb, p-cpe:/a:mandriva:linux:mariadb-bench, p-cpe:/a:mandriva:linux:mariadb-client, p-cpe:/a:mandriva:linux:mariadb-common, p-cpe:/a:mandriva:linux:mariadb-common-core, p-cpe:/a:mandriva:linux:mariadb-core, p-cpe:/a:mandriva:linux:mariadb-extra, p-cpe:/a:mandriva:linux:mariadb-feedback, p-cpe:/a:mandriva:linux:mariadb-obsolete, p-cpe:/a:mandriva:linux:mysql-MariaDB, cpe:/o:mandriva:business_server:1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/10/28

Reference Information

CVE: CVE-2014-6464, CVE-2014-6469, CVE-2014-6507, CVE-2014-6555, CVE-2014-6559

BID: 70446, 70451, 70487, 70530, 70550

MDVSA: 2014:210