Security update for mariadb-100 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0523-1 Final 1 1 2020-02-28T08:29:40Z current 2020-02-28T08:29:40Z 2020-02-28T08:29:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mariadb-100 This update for mariadb-100 fixes the following issues: MariaDB was updated to version 10.0.40-3 (bsc#1162388). Security issue fixed: - CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-523,SUSE-SLE-SDK-12-SP4-2020-523,SUSE-SLE-SDK-12-SP5-2020-523,SUSE-SLE-SERVER-12-SP4-2020-523,SUSE-SLE-SERVER-12-SP5-2020-523,SUSE-SLE-WE-12-SP4-2020-523,SUSE-SLE-WE-12-SP5-2020-523 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200523-1/ Link for SUSE-SU-2020:0523-1 https://lists.suse.com/pipermail/sle-security-updates/2020-February/006548.html E-Mail link for SUSE-SU-2020:0523-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1162388 SUSE Bug 1162388 https://www.suse.com/security/cve/CVE-2020-2574/ SUSE CVE CVE-2020-2574 page SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP4 SUSE Linux Enterprise Workstation Extension 12 SP5 libmysqlclient-devel-10.0.40.3-2.15.1 libmysqlclient18-10.0.40.3-2.15.1 libmysqlclient18-32bit-10.0.40.3-2.15.1 libmysqlclient18-64bit-10.0.40.3-2.15.1 libmysqlclient_r18-10.0.40.3-2.15.1 libmysqlclient_r18-32bit-10.0.40.3-2.15.1 libmysqlclient_r18-64bit-10.0.40.3-2.15.1 libmysqld-devel-10.0.40.3-2.15.1 libmysqld18-10.0.40.3-2.15.1 mariadb-100-10.0.40.3-2.15.1 mariadb-100-bench-10.0.40.3-2.15.1 mariadb-100-client-10.0.40.3-2.15.1 mariadb-100-errormessages-10.0.40.3-2.15.1 mariadb-100-test-10.0.40.3-2.15.1 mariadb-100-tools-10.0.40.3-2.15.1 libmysqlclient18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server 12 SP4 libmysqlclient18-32bit-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server 12 SP4 mariadb-100-errormessages-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server 12 SP4 libmysqlclient18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server 12 SP5 libmysqlclient18-32bit-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server 12 SP5 mariadb-100-errormessages-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server 12 SP5 libmysqlclient18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libmysqlclient18-32bit-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 mariadb-100-errormessages-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libmysqlclient18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libmysqlclient18-32bit-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 mariadb-100-errormessages-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libmysqlclient-devel-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libmysqlclient_r18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libmysqld-devel-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libmysqld18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libmysqlclient-devel-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libmysqlclient_r18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libmysqld-devel-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libmysqld18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libmysqlclient_r18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 libmysqlclient_r18-32bit-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 libmysqlclient_r18-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libmysqlclient_r18-32bit-10.0.40.3-2.15.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). CVE-2020-2574 SUSE Linux Enterprise Server 12 SP4:libmysqlclient18-10.0.40.3-2.15.1 SUSE Linux Enterprise Server 12 SP4:libmysqlclient18-32bit-10.0.40.3-2.15.1 SUSE Linux Enterprise Server 12 SP4:mariadb-100-errormessages-10.0.40.3-2.15.1 SUSE Linux Enterprise Server 12 SP5:libmysqlclient18-10.0.40.3-2.15.1 SUSE Linux Enterprise Server 12 SP5:libmysqlclient18-32bit-10.0.40.3-2.15.1 SUSE Linux Enterprise Server 12 SP5:mariadb-100-errormessages-10.0.40.3-2.15.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libmysqlclient18-10.0.40.3-2.15.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libmysqlclient18-32bit-10.0.40.3-2.15.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:mariadb-100-errormessages-10.0.40.3-2.15.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libmysqlclient18-10.0.40.3-2.15.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libmysqlclient18-32bit-10.0.40.3-2.15.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:mariadb-100-errormessages-10.0.40.3-2.15.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqlclient-devel-10.0.40.3-2.15.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqlclient_r18-10.0.40.3-2.15.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqld-devel-10.0.40.3-2.15.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libmysqld18-10.0.40.3-2.15.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqlclient-devel-10.0.40.3-2.15.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqlclient_r18-10.0.40.3-2.15.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqld-devel-10.0.40.3-2.15.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libmysqld18-10.0.40.3-2.15.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libmysqlclient_r18-10.0.40.3-2.15.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libmysqlclient_r18-32bit-10.0.40.3-2.15.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libmysqlclient_r18-10.0.40.3-2.15.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libmysqlclient_r18-32bit-10.0.40.3-2.15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200523-1/ https://www.suse.com/security/cve/CVE-2020-2574.html CVE-2020-2574 https://bugzilla.suse.com/1161085 SUSE Bug 1161085 https://bugzilla.suse.com/1162388 SUSE Bug 1162388