CVE-2015-4792

This update provides the upstream 10.0.22 maintenance release and fixes the following security issues:

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792. (CVE-2015-4802)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL. (CVE-2015-4815)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types. (CVE-2015-4826)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. (CVE-2015-4830)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : SP. (CVE-2015-4836)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913. (CVE-2015-4858)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4861)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser. (CVE-2015-4870)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858. (CVE-2015-4913)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802. (CVE-2015-4792)

For other fixes in this update, see the referenced release notes.

These are all security issues fixed in the libmysqlclient-devel-10.0.22-3.8 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmysql56client18-32bit-5.6.34-1.1 package on the GA media of openSUSE Tumbleweed.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

The mysql package was updated to version 5.5.46 to fixs several security and non security issues.

• bnc#951391: update to version 5.5.46
  • changes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html
  • fixed CVEs: CVE-2015-1793, CVE-2015-0286, CVE-2015-0288, CVE-2015-1789, CVE-2015-4730, CVE-2015-4766, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913
• bnc#952196: Fixed a build error for ppc*, s390* and ia64 architectures.

MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements.

The following CVEs have been fixed:

• 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792
• 10.0.21: CVE-2015-4816, CVE-2015-4819, CVE-2015-4879, CVE-2015-4895

The following non-security issues have been fixed:

• Fix rc.mysql-multi script to properly start instances after restart. (bsc#934401)
• Fix rc.mysql-multi script to restart after crash. (bsc#937258)

For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents:

• https://kb.askmonty.org/en/mariadb-10022-release-notes/
• https://kb.askmonty.org/en/mariadb-10021-release-notes/
• https://kb.askmonty.org/en/mariadb-10022-changelog/
• https://kb.askmonty.org/en/mariadb-10021-changelog/

MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements.

The following CVEs have been fixed:

• 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792
• Fix information leak via mysql-systemd-helper script. (CVE-2015-5969, bsc#957174)

For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents:

• https://kb.askmonty.org/en/mariadb-10022-release-notes/
• https://kb.askmonty.org/en/mariadb-10022-changelog/

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802.

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.5.46 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 15.04 and Ubuntu 15.10 have been updated to MySQL 5.6.27.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-45.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-26.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-27.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html