openSUSE Security Update : mariadb (openSUSE-2017-257)

Medium Nessus Plugin ID 97277

Synopsis

The remote openSUSE host is missing a security update.

Description

This mariadb version update to 10.0.29 fixes the following issues :

 - CVE-2017-3318: unspecified vulnerability affecting Error Handling (bsc#1020896)

 - CVE-2017-3317: unspecified vulnerability affecting Logging (bsc#1020894)

 - CVE-2017-3312: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 (bsc#1020873)

 - CVE-2017-3291: unrestricted mysqld_safe's ledir (bsc#1020884)

 - CVE-2017-3265: unsafe chmod/chown use in init script (bsc#1020885)

 - CVE-2017-3258: unspecified vulnerability in the DDL component (bsc#1020875)

 - CVE-2017-3257: unspecified vulnerability affecting InnoDB (bsc#1020878)

 - CVE-2017-3244: unspecified vulnerability affecing the DML component (bsc#1020877)

 - CVE-2017-3243: unspecified vulnerability affecting the Charsets component (bsc#1020891)

 - CVE-2017-3238: unspecified vulnerability affecting the Optimizer component (bsc#1020882)

 - CVE-2016-6664: Root Privilege Escalation (bsc#1008253)

 - Applications using the client library for MySQL (libmysqlclient.so) had a use-after-free issue that could cause the applications to crash (bsc#1022428)

 - notable changes :

 - XtraDB updated to 5.6.34-79.1

 - TokuDB updated to 5.6.34-79.1

 - Innodb updated to 5.6.35

 - Performance Schema updated to 5.6.35

Release notes and changelog :

 - https://kb.askmonty.org/en/mariadb-10029-release-notes

 - https://kb.askmonty.org/en/mariadb-10029-changelog

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Solution

Update the affected mariadb packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1008253

https://bugzilla.opensuse.org/show_bug.cgi?id=1020868

https://bugzilla.opensuse.org/show_bug.cgi?id=1020873

https://bugzilla.opensuse.org/show_bug.cgi?id=1020875

https://bugzilla.opensuse.org/show_bug.cgi?id=1020877

https://bugzilla.opensuse.org/show_bug.cgi?id=1020878

https://bugzilla.opensuse.org/show_bug.cgi?id=1020882

https://bugzilla.opensuse.org/show_bug.cgi?id=1020884

https://bugzilla.opensuse.org/show_bug.cgi?id=1020885

https://bugzilla.opensuse.org/show_bug.cgi?id=1020891

https://bugzilla.opensuse.org/show_bug.cgi?id=1020894

https://bugzilla.opensuse.org/show_bug.cgi?id=1020896

https://bugzilla.opensuse.org/show_bug.cgi?id=1022428

https://mariadb.com/kb/en/library/mariadb-10029-changelog/

https://mariadb.com/kb/en/library/mariadb-10029-release-notes/

Plugin Details

Severity: Medium

ID: 97277

File Name: openSUSE-2017-257.nasl

Version: 3.4

Type: local

Agent: unix

Published: 2017/02/21

Updated: 2019/04/10

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.9

Temporal Score: 6

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSS v3.0

Base Score: 7

Temporal Score: 6.7

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:libmysqlclient-devel, p-cpe:/a:novell:opensuse:libmysqlclient18, p-cpe:/a:novell:opensuse:libmysqlclient18-32bit, p-cpe:/a:novell:opensuse:libmysqlclient18-debuginfo, p-cpe:/a:novell:opensuse:libmysqlclient18-debuginfo-32bit, p-cpe:/a:novell:opensuse:libmysqlclient_r18, p-cpe:/a:novell:opensuse:libmysqlclient_r18-32bit, p-cpe:/a:novell:opensuse:libmysqld-devel, p-cpe:/a:novell:opensuse:libmysqld18, p-cpe:/a:novell:opensuse:libmysqld18-debuginfo, p-cpe:/a:novell:opensuse:mariadb, p-cpe:/a:novell:opensuse:mariadb-bench, p-cpe:/a:novell:opensuse:mariadb-bench-debuginfo, p-cpe:/a:novell:opensuse:mariadb-client, p-cpe:/a:novell:opensuse:mariadb-client-debuginfo, p-cpe:/a:novell:opensuse:mariadb-debuginfo, p-cpe:/a:novell:opensuse:mariadb-debugsource, p-cpe:/a:novell:opensuse:mariadb-errormessages, p-cpe:/a:novell:opensuse:mariadb-test, p-cpe:/a:novell:opensuse:mariadb-test-debuginfo, p-cpe:/a:novell:opensuse:mariadb-tools, p-cpe:/a:novell:opensuse:mariadb-tools-debuginfo, cpe:/o:novell:opensuse:42.1, cpe:/o:novell:opensuse:42.2

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/02/16

Reference Information

CVE: CVE-2016-6664, CVE-2017-3238, CVE-2017-3243, CVE-2017-3244, CVE-2017-3257, CVE-2017-3258, CVE-2017-3265, CVE-2017-3291, CVE-2017-3312, CVE-2017-3317, CVE-2017-3318