CVE-2016-3477

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser.

The mariadb package has been updated to version 10.0.26. It fixes several security issues (CVE-2016-3477, CVE-2016-3521, CVE-2016-3615, CVE-2016-5440) and other bugs. See the upstream release notes for details.

These are all security issues fixed in the libmysql56client18-32bit-5.6.34-1.1 package on the GA media of openSUSE Tumbleweed.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb fixes the following issues:

• CVE-2016-3477: Unspecified vulnerability in subcomponent parser [bsc#991616]
• CVE-2016-3521: Unspecified vulnerability in subcomponent types [bsc#991616]
• CVE-2016-3615: Unspecified vulnerability in subcomponent dml [bsc#991616]
• CVE-2016-5440: Unspecified vulnerability in subcomponent rbr [bsc#991616]
• mariadb failing test main.bootstrap [bsc#984858]
• left over 'openSUSE' comments in MariaDB on SLE12 GM and SP1 [bsc#985217]
• remove unnecessary conditionals from specfile
• add '--ignore-db-dir=lost+found' option to rc.mysql-multi in order not to misinterpret the lost+found directory as a database [bsc#986251]

This update for mariadb fixes the following issues:

• CVE-2016-3477: Unspecified vulnerability in subcomponent parser [bsc#991616]
• CVE-2016-3521: Unspecified vulnerability in subcomponent types [bsc#991616]
• CVE-2016-3615: Unspecified vulnerability in subcomponent dml [bsc#991616]
• CVE-2016-5440: Unspecified vulnerability in subcomponent rbr [bsc#991616]
• mariadb failing test main.bootstrap [bsc#984858]
• left over 'openSUSE' comments in MariaDB on SLE12 GM and SP1 [bsc#985217]
• remove unnecessary conditionals from specfile
• add '--ignore-db-dir=lost+found' option to rc.mysql-multi in order not to misinterpret the lost+found directory as a database [bsc#986251]

This mysql update to verson 5.5.52 fixes the following issues:

Security issues fixed:

• CVE-2016-3477: Fixed unspecified vulnerability in subcomponent parser (bsc#989913).
• CVE-2016-3521: Fixed unspecified vulnerability in subcomponent types (bsc#989919).
• CVE-2016-3615: Fixed unspecified vulnerability in subcomponent dml (bsc#989922).
• CVE-2016-5440: Fixed unspecified vulnerability in subcomponent rbr (bsc#989926).
• CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and , under certain circumstances, execute arbitrary code as mysql (or even root) user. (bsc#998309)

More details can be found on: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-52.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-51.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-50.html

Bugs fixed:

• bsc#967374: properly restart mysql multi instances during upgrade
• bnc#937258: multi script to restart after crash

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.5.50 in Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 15.10 has been updated to MySQL 5.6.31. Ubuntu 16.04 LTS has been updated to MySQL 5.7.13.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-50.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-31.html http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-13.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html