CVE-2022-32089

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22).

Security Fix(es):

• mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)
• mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)
• mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)
• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)
• mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)
• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)
• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)
• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22).

Security Fix(es):

• mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)
• mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)
• mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)
• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)
• mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)
• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)
• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)
• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. (CVE-2018-25032) A use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc. (CVE-2022-32081) An assertion failure at table->get_ref_count() == 0 in dict0dict.cc. (CVE-2022-32082) Segmentation fault via the component sub_select. (CVE-2022-32084) Segmentation fault via the component st_select_lex_unit::exclude_level. (CVE-2022-32089)

These are all security issues fixed in the libmariadbd-devel-10.9.3-1.1 package on the GA media of openSUSE Tumbleweed.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22).

Security Fix(es):

• mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

• mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081)

• mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082)

• mariadb: segmentation fault via the component sub_select (CVE-2022-32084)

• mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089)

• mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)

• mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)

• mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb fixes the following issues:

• Updated to 10.6.9:

  • CVE-2022-32082: Fixed a reachable assertion that would crash the server (bsc#1201162).
  • CVE-2022-32089: Fixed a segmentation fault that coudl be triggered via a crafted query (bsc#1201169).
  • CVE-2022-32081: Fixed a buffer overflow on instant ADD/DROP of generated column (bsc#1201161).
  • CVE-2022-32091: Fixed a memory corruption issue that could be triggered via a crafted query (bsc#1201170).
  • CVE-2022-32084: Fixed a segmentation fault on INSERT SELECT queries (bsc#1201164).

• Additionaly, the following issues were previously fixed:

  • CVE-2022-32088: Fixed a server crash when using ORDER BY with window function and UNION(bsc#1201168).
  • CVE-2022-32087: Fixed a segmentation fault that could be triggered via a crafted query (bsc#1201167).
  • CVE-2022-32086: Fixed a server crash on INSERT SELECT queries (bsc#1201166).
  • CVE-2022-32085: Fixed a segmentation fault that could be triggered via a crafted query (bsc#1201165).
  • CVE-2022-32083: Fixed a segmentation fault that could be triggered via a crafted query (bsc#1201163).

Bugfixes:

• Update mysql-systemd-helper to be aware of custom group (bsc#1200105).

This update for mariadb fixes the following issues:

Update to 10.4.26:

• CVE-2022-32089 (bsc#1201169)
• CVE-2022-32081 (bsc#1201161)
• CVE-2022-32091 (bsc#1201170)
• CVE-2022-32084 (bsc#1201164)
• CVE-2018-25032 (bsc#1197459)
• CVE-2022-32088 (bsc#1201168)
• CVE-2022-32087 (bsc#1201167)
• CVE-2022-32086 (bsc#1201166)
• CVE-2022-32085 (bsc#1201165)
• CVE-2022-32083 (bsc#1201163)

Bugfixes:

• Update mysql-systemd-helper to be aware of custom group (bsc#1200105).

External references:

• https://mariadb.com/kb/en/library/mariadb-10426-release-notes
• https://mariadb.com/kb/en/library/mariadb-10426-changelog

This update for mariadb fixes the following issues:

Update to 10.5.17:

• CVE-2022-32082: Fixed assertion failure at table->get_ref_count() == 0 in dict0dict.cc (bsc#1201162).

• CVE-2022-32089: Fixed segmentation fault via the component st_select_lex_unit::exclude_level (bsc#1201169).

• CVE-2022-32081: Fixed use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc (bsc#1201161).

• CVE-2022-32091: Fixed use-after-poison in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc (bsc#1201170).

• CVE-2022-32084: Fixed segmentation fault via the component sub_select (bsc#1201164).

• CVE-2022-38791: Fixed deadlock in compress_write in extra/mariabackup/ds_compress.cc (bsc#1202863).

• CVE-2022-32088: Fixed segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (bsc#1201168).

• CVE-2022-32087: Fixed segmentation fault via the component Item_args::walk_args (bsc#1201167).

• CVE-2022-32086: Fixed segmentation fault via the component Item_field::fix_outer_field (bsc#1201166).

• CVE-2022-32085: Fixed segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor (bsc#1201165).

• CVE-2022-32083: Fixed segmentation fault via the component Item_subselect::init_expr_cache_tracker (bsc#1201163).

Bugfixes:

• Fixed mysql-systemd-helper being unaware of custom group (bsc#1200105).

Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues.

MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.