Security update for mariadb SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1315-1 Final 1 1 2017-05-16T13:41:55Z current 2017-05-16T13:41:55Z 2017-05-16T13:41:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mariadb This update for mariadb fixes the following issues: - update to MariaDB 10.0.30 GA * notable changes: * XtraDB updated to 5.6.35-80.0 * TokuDB updated to 5.6.35-80.0 * PCRE updated to 8.40 * MDEV-11027: better InnoDB crash recovery progress reporting * MDEV-11520: improvements to how InnoDB data files are extended * Improvements to InnoDB startup/shutdown to make it more robust * MDEV-11233: fix for FULLTEXT index crash * MDEV-6143: MariaDB Linux binary tarballs will now always untar to directories that match their filename * release notes and changelog: * https://kb.askmonty.org/en/mariadb-10030-release-notes * https://kb.askmonty.org/en/mariadb-10030-changelog * fixes the following CVEs: CVE-2017-3313: unspecified vulnerability affecting the MyISAM component [bsc#1020890] CVE-2017-3302: Use after free in libmysqlclient.so [bsc#1022428] - set the default umask to 077 in mysql-systemd-helper [bsc#1020976] - [bsc#1034911] - tracker bug * fixes also [bsc#1020868] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2017-795,SUSE-SLE-DESKTOP-12-SP2-2017-795,SUSE-SLE-RPI-12-SP2-2017-795,SUSE-SLE-SDK-12-SP1-2017-795,SUSE-SLE-SDK-12-SP2-2017-795,SUSE-SLE-SERVER-12-SP1-2017-795,SUSE-SLE-SERVER-12-SP2-2017-795,SUSE-SLE-WE-12-SP1-2017-795,SUSE-SLE-WE-12-SP2-2017-795 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171315-1/ Link for SUSE-SU-2017:1315-1 https://lists.opensuse.org/opensuse-security-announce/2017-05/msg00051.html E-Mail link for SUSE-SU-2017:1315-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1020868 SUSE Bug 1020868 https://bugzilla.suse.com/1020890 SUSE Bug 1020890 https://bugzilla.suse.com/1020976 SUSE Bug 1020976 https://bugzilla.suse.com/1022428 SUSE Bug 1022428 https://bugzilla.suse.com/1034911 SUSE Bug 1034911 https://bugzilla.suse.com/996821 SUSE Bug 996821 https://www.suse.com/security/cve/CVE-2017-3302/ SUSE CVE CVE-2017-3302 page https://www.suse.com/security/cve/CVE-2017-3313/ SUSE CVE CVE-2017-3313 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Workstation Extension 12 SP1 SUSE Linux Enterprise Workstation Extension 12 SP2 libmysqlclient18-10.0.30-25.1 libmysqlclient18-32bit-10.0.30-25.1 libmysqlclient_r18-10.0.30-25.1 libmysqlclient_r18-32bit-10.0.30-25.1 mariadb-10.0.30-25.1 mariadb-client-10.0.30-25.1 mariadb-errormessages-10.0.30-25.1 mariadb-tools-10.0.30-25.1 libmysqlclient-devel-10.0.30-25.1 libmysqld-devel-10.0.30-25.1 libmysqld18-10.0.30-25.1 libmysqlclient18-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libmysqlclient18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libmysqlclient_r18-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libmysqlclient_r18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 mariadb-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 mariadb-client-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 mariadb-errormessages-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libmysqlclient18-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libmysqlclient18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libmysqlclient_r18-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libmysqlclient_r18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 mariadb-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 mariadb-client-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 mariadb-errormessages-10.0.30-25.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libmysqlclient18-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP1 libmysqlclient18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP1 mariadb-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP1 mariadb-client-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP1 mariadb-errormessages-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP1 mariadb-tools-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP1 libmysqlclient18-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP2 libmysqlclient18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP2 mariadb-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP2 mariadb-client-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP2 mariadb-errormessages-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP2 mariadb-tools-10.0.30-25.1 as a component of SUSE Linux Enterprise Server 12 SP2 libmysqlclient18-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 mariadb-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 mariadb-client-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 mariadb-errormessages-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 mariadb-tools-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libmysqlclient18-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libmysqlclient18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 mariadb-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 mariadb-client-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 mariadb-errormessages-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 mariadb-tools-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libmysqlclient18-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libmysqlclient18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 mariadb-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 mariadb-client-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 mariadb-errormessages-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 mariadb-tools-10.0.30-25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libmysqlclient-devel-10.0.30-25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 libmysqlclient_r18-10.0.30-25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 libmysqld-devel-10.0.30-25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 libmysqld18-10.0.30-25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 libmysqlclient-devel-10.0.30-25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libmysqlclient_r18-10.0.30-25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libmysqld-devel-10.0.30-25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libmysqld18-10.0.30-25.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libmysqlclient_r18-10.0.30-25.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP1 libmysqlclient_r18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP1 libmysqlclient_r18-10.0.30-25.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP2 libmysqlclient_r18-32bit-10.0.30-25.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP2 Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3. CVE-2017-3302 SUSE Linux Enterprise Desktop 12 SP1:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:libmysqlclient_r18-32bit-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:mariadb-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:libmysqlclient_r18-32bit-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:mariadb-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libmysqlclient-devel-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libmysqld-devel-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libmysqld18-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libmysqlclient-devel-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libmysqld-devel-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libmysqld18-10.0.30-25.1 SUSE Linux Enterprise Workstation Extension 12 SP1:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Workstation Extension 12 SP1:libmysqlclient_r18-32bit-10.0.30-25.1 SUSE Linux Enterprise Workstation Extension 12 SP2:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Workstation Extension 12 SP2:libmysqlclient_r18-32bit-10.0.30-25.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171315-1/ https://www.suse.com/security/cve/CVE-2017-3302.html CVE-2017-3302 https://bugzilla.suse.com/1022428 SUSE Bug 1022428 https://bugzilla.suse.com/1034850 SUSE Bug 1034850 https://bugzilla.suse.com/1034911 SUSE Bug 1034911 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS v3.0 Base Score 4.7 (Confidentiality impacts). CVE-2017-3313 SUSE Linux Enterprise Desktop 12 SP1:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:libmysqlclient_r18-32bit-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:mariadb-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP1:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:libmysqlclient_r18-32bit-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:mariadb-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Desktop 12 SP2:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP1:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server 12 SP2:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libmysqlclient18-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libmysqlclient18-32bit-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:mariadb-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:mariadb-client-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:mariadb-errormessages-10.0.30-25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:mariadb-tools-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libmysqlclient-devel-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libmysqld-devel-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libmysqld18-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libmysqlclient-devel-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libmysqld-devel-10.0.30-25.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libmysqld18-10.0.30-25.1 SUSE Linux Enterprise Workstation Extension 12 SP1:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Workstation Extension 12 SP1:libmysqlclient_r18-32bit-10.0.30-25.1 SUSE Linux Enterprise Workstation Extension 12 SP2:libmysqlclient_r18-10.0.30-25.1 SUSE Linux Enterprise Workstation Extension 12 SP2:libmysqlclient_r18-32bit-10.0.30-25.1 low 3.8 AV:L/AC:H/Au:S/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171315-1/ https://www.suse.com/security/cve/CVE-2017-3313.html CVE-2017-3313 https://bugzilla.suse.com/1020868 SUSE Bug 1020868 https://bugzilla.suse.com/1020890 SUSE Bug 1020890 https://bugzilla.suse.com/1034911 SUSE Bug 1034911