CVE-2016-3492

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

A race condition was found in the way MariaDB performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user (CVE-2016-6663).

This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section (CVE-2016-3492, CVE-2016-5584, CVE-2016-5616, CVE-2016-5624, CVE-2016-5626, CVE-2016-5629, CVE-2016-7440, CVE-2016-8283).

These are all security issues fixed in the libmysql56client18-32bit-5.6.34-1.1 package on the GA media of openSUSE Tumbleweed.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This mariadb update to version 10.0.28 fixes the following issues (bsc#1008318):

Security fixes:

• CVE-2016-8283: Unspecified vulnerability in subcomponent Types (bsc#1005582)
• CVE-2016-7440: Unspecified vulnerability in subcomponent Encryption (bsc#1005581)
• CVE-2016-5629: Unspecified vulnerability in subcomponent Federated (bsc#1005569)
• CVE-2016-5626: Unspecified vulnerability in subcomponent GIS (bsc#1005566)
• CVE-2016-5624: Unspecified vulnerability in subcomponent DML (bsc#1005564)
• CVE-2016-5616: Unspecified vulnerability in subcomponent MyISAM (bsc#1005562)
• CVE-2016-5584: Unspecified vulnerability in subcomponent Encryption (bsc#1005558)
• CVE-2016-3492: Unspecified vulnerability in subcomponent Optimizer (bsc#1005555)
• CVE-2016-6663: Privilege Escalation / Race Condition (bsc#1001367)

Bugfixes:

• mysql_install_db can't find data files (bsc#1006539)
• mariadb failing test sys_vars.optimizer_switch_basic (bsc#1003800)
• Notable changes:
  • XtraDB updated to 5.6.33-79.0
  • TokuDB updated to 5.6.33-79.0
  • Innodb updated to 5.6.33
  • Performance Schema updated to 5.6.33
• Release notes and upstream changelog:
  • https://kb.askmonty.org/en/mariadb-10028-release-notes
  • https://kb.askmonty.org/en/mariadb-10028-changelog

This mariadb update to version 10.0.28 fixes the following issues (bsc#1008318):

Security fixes:

• CVE-2016-8283: Unspecified vulnerability in subcomponent Types (bsc#1005582)
• CVE-2016-7440: Unspecified vulnerability in subcomponent Encryption (bsc#1005581)
• CVE-2016-5629: Unspecified vulnerability in subcomponent Federated (bsc#1005569)
• CVE-2016-5626: Unspecified vulnerability in subcomponent GIS (bsc#1005566)
• CVE-2016-5624: Unspecified vulnerability in subcomponent DML (bsc#1005564)
• CVE-2016-5616: Unspecified vulnerability in subcomponent MyISAM (bsc#1005562)
• CVE-2016-5584: Unspecified vulnerability in subcomponent Encryption (bsc#1005558)
• CVE-2016-3492: Unspecified vulnerability in subcomponent Optimizer (bsc#1005555)
• CVE-2016-6663: Privilege Escalation / Race Condition (bsc#1001367)

Bugfixes:

• mysql_install_db can't find data files (bsc#1006539)
• mariadb failing test sys_vars.optimizer_switch_basic (bsc#1003800)
• Remove useless [email protected] (bsc#1004477)
• Replace all occurrences of the string '@sysconfdir@' with '/etc' as it wasn't expanded properly (bsc#990890)
• Notable changes:
  • XtraDB updated to 5.6.33-79.0
  • TokuDB updated to 5.6.33-79.0
  • Innodb updated to 5.6.33
  • Performance Schema updated to 5.6.33
• Release notes and upstream changelog:
  • https://kb.askmonty.org/en/mariadb-10028-release-notes
  • https://kb.askmonty.org/en/mariadb-10028-changelog