The following packages have been upgraded to a later upstream version:
mariadb (5.5.60).

Security Fix(es) :

  - mysql: Client programs unspecified vulnerability (CPU     Jul 2017) (CVE-2017-3636)

  - mysql: Server: DML unspecified vulnerability (CPU Jul     2017) (CVE-2017-3641)

  - mysql: Client mysqldump unspecified vulnerability (CPU     Jul 2017) (CVE-2017-3651)

  - mysql: Server: Replication unspecified vulnerability     (CPU Oct 2017) (CVE-2017-10268)

  - mysql: Server: Optimizer unspecified vulnerability (CPU     Oct 2017) (CVE-2017-10378)

  - mysql: Client programs unspecified vulnerability (CPU     Oct 2017) (CVE-2017-10379)

  - mysql: Server: DDL unspecified vulnerability (CPU Oct     2017) (CVE-2017-10384)

  - mysql: Server: Partition unspecified vulnerability (CPU     Jan 2018) (CVE-2018-2562)

  - mysql: Server: DDL unspecified vulnerability (CPU Jan     2018) (CVE-2018-2622)

  - mysql: Server: Optimizer unspecified vulnerability (CPU     Jan 2018) (CVE-2018-2640)

  - mysql: Server: Optimizer unspecified vulnerability (CPU     Jan 2018) (CVE-2018-2665)

  - mysql: Server: Optimizer unspecified vulnerability (CPU     Jan 2018) (CVE-2018-2668)

  - mysql: Server: Replication unspecified vulnerability     (CPU Apr 2018) (CVE-2018-2755)

  - mysql: Client programs unspecified vulnerability (CPU     Apr 2018) (CVE-2018-2761)

  - mysql: Server: Locking unspecified vulnerability (CPU     Apr 2018) (CVE-2018-2771)

  - mysql: Server: Optimizer unspecified vulnerability (CPU     Apr 2018) (CVE-2018-2781)

  - mysql: Server: DDL unspecified vulnerability (CPU Apr     2018) (CVE-2018-2813)

  - mysql: Server: DDL unspecified vulnerability (CPU Apr     2018) (CVE-2018-2817)

  - mysql: InnoDB unspecified vulnerability (CPU Apr 2018)     (CVE-2018-2819)

  - mysql: Server: DDL unspecified vulnerability (CPU Jul     2017) (CVE-2017-3653)

  - mysql: use of SSL/TLS not enforced in libmysqld (Return     of BACKRONYM) (CVE-2018-2767)

Bug Fix(es) :

  - Previously, the mysqladmin tool waited for an inadequate     length of time if the socket it listened on did not     respond in a specific way. Consequently, when the socket     was used while the MariaDB server was starting, the     mariadb service became unresponsive for a long time.
    With this update, the mysqladmin timeout has been     shortened to 2 seconds. As a result, the mariadb service     either starts or fails but no longer hangs in the     described situation.

**MariaDB 10.2.13**

Release notes :

https://mariadb.com/kb/en/library/mariadb-10213-release-notes/

CVEs fixed :

CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668

Bugs fixed :

POSTIN scriplets fix for:
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4a4dc47afe

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mariadb fixes the following issues: MariaDB was updated to 10.0.34 (bsc#1078431) The following security vulnerabilities are fixed :

  - CVE-2018-2562: Vulnerability in the MySQL Server     subcomponent: Server : Partition. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server as well as unauthorized update, insert or delete     access to some of MySQL Server accessible data.

  - CVE-2018-2622: Vulnerability in the MySQL Server     subcomponent: Server: DDL. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server.

  - CVE-2018-2640: Vulnerability in the MySQL Server     subcomponent: Server: Optimizer. Successful attacks of     this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server.

  - CVE-2018-2665: Vulnerability in the MySQL Server     subcomponent: Server: Optimizer. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server.

  - CVE-2018-2668: Vulnerability in the MySQL Server     subcomponent: Server: Optimizer. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server.

  - CVE-2018-2612: Vulnerability in the MySQL Server     subcomponent: InnoDB. Easily exploitable vulnerability     allowed high privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access     to critical data or all MySQL Server accessible data and     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. The     MariaDB external release notes and changelog for this     release :

- https://kb.askmonty.org/en/mariadb-10034-release-notes

- https://kb.askmonty.org/en/mariadb-10034-changelog

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3308:01 advisory.

    * mysql: Client programs unspecified vulnerability (CPU Jul 2017) (CVE-2017-3636)
    * mysql: Server: DML unspecified vulnerability (CPU Jul 2017) (CVE-2017-3641)
    * mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017) (CVE-2017-3651)
    * mysql: Server: Replication unspecified vulnerability (CPU Oct 2017) (CVE-2017-10268)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017) (CVE-2017-10378)
    * mysql: Client programs unspecified vulnerability (CPU Oct 2017) (CVE-2017-10379)
    * mysql: Server: DDL unspecified vulnerability (CPU Oct 2017) (CVE-2017-10384)
    * mysql: Server: Partition unspecified vulnerability (CPU Jan 2018) (CVE-2018-2562)
    * mysql: Server: DDL unspecified vulnerability (CPU Jan 2018) (CVE-2018-2622)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018) (CVE-2018-2640)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018) (CVE-2018-2665)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018) (CVE-2018-2668)
    * mysql: Server: Replication unspecified vulnerability (CPU Apr 2018) (CVE-2018-2755)
    * mysql: Client programs unspecified vulnerability (CPU Apr 2018) (CVE-2018-2761)
    * mysql: Server: Locking unspecified vulnerability (CPU Apr 2018) (CVE-2018-2771)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2018) (CVE-2018-2781)
    * mysql: Server: DDL unspecified vulnerability (CPU Apr 2018) (CVE-2018-2813)
    * mysql: Server: DDL unspecified vulnerability (CPU Apr 2018) (CVE-2018-2817)
    * mysql: InnoDB unspecified vulnerability (CPU Apr 2018) (CVE-2018-2819)
    * mysql: Server: DDL unspecified vulnerability (CPU Jul 2017) (CVE-2017-3653)
    * mysql: use of SSL/TLS not enforced in libmysqld (Return of BACKRONYM) (CVE-2018-2767)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
111806	Scientific Linux Security Update : mariadb on SL7.x x86_64 (20180816)	Nessus	Scientific Linux Local Security Checks	8/17/2018	8/19/2024	high
108305	Fedora 27 : 3:mariadb (2018-00647ae0d5)	Nessus	Fedora Local Security Checks	3/14/2018	2/4/2025	high
108401	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2018:0697-1)	Nessus	SuSE Local Security Checks	3/16/2018	1/30/2025	high
289222	MiracleLinux 7 : mariadb-5.5.60-1.el7 (AXSA:2018-3308:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high

Detections

Analytics

Plugins Search

high

high

high

high