CVE-2016-7440

The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences.

A race condition was found in the way MariaDB performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user (CVE-2016-6663).

This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section (CVE-2016-3492, CVE-2016-5584, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-7440, CVE-2016-8283).

These are all security issues fixed in the libmysql56client18-32bit-5.6.34-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmariadbd-devel-10.6.4-2.1 package on the GA media of openSUSE Tumbleweed.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This mysql version update to 5.5.53 fixes the following issues:

• CVE-2016-6662: Unspecified vulnerability in subcomponent Logging (bsc#1005580)
• CVE-2016-7440: Unspecified vulnerability in subcomponent Encryption (bsc#1005581)
• CVE-2016-5584: Unspecified vulnerability in subcomponent Encryption (bsc#1005558)

Release Notes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-53.html

This mariadb update to version 10.0.28 fixes the following issues (bsc#1008318):

Security fixes:

• CVE-2016-8283: Unspecified vulnerability in subcomponent Types (bsc#1005582)
• CVE-2016-7440: Unspecified vulnerability in subcomponent Encryption (bsc#1005581)
• CVE-2016-5629: Unspecified vulnerability in subcomponent Federated (bsc#1005569)
• CVE-2016-5626: Unspecified vulnerability in subcomponent GIS (bsc#1005566)
• CVE-2016-5624: Unspecified vulnerability in subcomponent DML (bsc#1005564)
• CVE-2016-5616: Unspecified vulnerability in subcomponent MyISAM (bsc#1005562)
• CVE-2016-5584: Unspecified vulnerability in subcomponent Encryption (bsc#1005558)
• CVE-2016-3492: Unspecified vulnerability in subcomponent Optimizer (bsc#1005555)
• CVE-2016-6663: Privilege Escalation / Race Condition (bsc#1001367)

Bugfixes:

• mysql_install_db can't find data files (bsc#1006539)
• mariadb failing test sys_vars.optimizer_switch_basic (bsc#1003800)
• Notable changes:
  • XtraDB updated to 5.6.33-79.0
  • TokuDB updated to 5.6.33-79.0
  • Innodb updated to 5.6.33
  • Performance Schema updated to 5.6.33
• Release notes and upstream changelog:
  • https://kb.askmonty.org/en/mariadb-10028-release-notes
  • https://kb.askmonty.org/en/mariadb-10028-changelog

This mariadb update to version 10.0.28 fixes the following issues (bsc#1008318):

Security fixes:

• CVE-2016-8283: Unspecified vulnerability in subcomponent Types (bsc#1005582)
• CVE-2016-7440: Unspecified vulnerability in subcomponent Encryption (bsc#1005581)
• CVE-2016-5629: Unspecified vulnerability in subcomponent Federated (bsc#1005569)
• CVE-2016-5626: Unspecified vulnerability in subcomponent GIS (bsc#1005566)
• CVE-2016-5624: Unspecified vulnerability in subcomponent DML (bsc#1005564)
• CVE-2016-5616: Unspecified vulnerability in subcomponent MyISAM (bsc#1005562)
• CVE-2016-5584: Unspecified vulnerability in subcomponent Encryption (bsc#1005558)
• CVE-2016-3492: Unspecified vulnerability in subcomponent Optimizer (bsc#1005555)
• CVE-2016-6663: Privilege Escalation / Race Condition (bsc#1001367)

Bugfixes:

• mysql_install_db can't find data files (bsc#1006539)
• mariadb failing test sys_vars.optimizer_switch_basic (bsc#1003800)
• Remove useless [email protected] (bsc#1004477)
• Replace all occurrences of the string '@sysconfdir@' with '/etc' as it wasn't expanded properly (bsc#990890)
• Notable changes:
  • XtraDB updated to 5.6.33-79.0
  • TokuDB updated to 5.6.33-79.0
  • Innodb updated to 5.6.33
  • Performance Schema updated to 5.6.33
• Release notes and upstream changelog:
  • https://kb.askmonty.org/en/mariadb-10028-release-notes
  • https://kb.askmonty.org/en/mariadb-10028-changelog

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.5.53 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 16.04 LTS and Ubuntu 16.10 have been updated to MySQL 5.7.16.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-53.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-16.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html