CVE-2019-2737

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld, and many client programs.

The following packages have been upgraded to a later upstream version: mysql (8.0.17).

Security Fix(es):

• mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2800, CVE-2019-2436, CVE-2019-2531, CVE-2019-2534, CVE-2019-2614, CVE-2019-2617, CVE-2019-2630, CVE-2019-2634, CVE-2019-2635, CVE-2019-2755)

• mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2420, CVE-2019-2481, CVE-2019-2507, CVE-2019-2529, CVE-2019-2530, CVE-2019-2581, CVE-2019-2596, CVE-2019-2607, CVE-2019-2625, CVE-2019-2681, CVE-2019-2685, CVE-2019-2686, CVE-2019-2687, CVE-2019-2688, CVE-2019-2689, CVE-2019-2693, CVE-2019-2694, CVE-2019-2695, CVE-2019-2757, CVE-2019-2774, CVE-2019-2796, CVE-2019-2802, CVE-2019-2803, CVE-2019-2808, CVE-2019-2810, CVE-2019-2812, CVE-2019-2815, CVE-2019-2830, CVE-2019-2834)

• mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-2434, CVE-2019-2455, CVE-2019-2805)

• mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2482, CVE-2019-2592)

• mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2019-2486, CVE-2019-2532, CVE-2019-2533, CVE-2019-2584, CVE-2019-2589, CVE-2019-2606, CVE-2019-2620, CVE-2019-2627, CVE-2019-2739, CVE-2019-2778, CVE-2019-2811, CVE-2019-2789)

• mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2494, CVE-2019-2495, CVE-2019-2537, CVE-2019-2626, CVE-2019-2644)

• mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2502, CVE-2019-2510, CVE-2019-2580, CVE-2019-2585, CVE-2019-2593, CVE-2019-2624, CVE-2019-2628, CVE-2019-2758, CVE-2019-2785, CVE-2019-2798, CVE-2019-2879, CVE-2019-2814)

• mysql: Server: Connection Handling unspecified vulnerability (CVE-2019-2503)

• mysql: Server: Partition multiple unspecified vulnerabilities (CVE-2019-2528, CVE-2019-2587)

• mysql: Server: Options multiple unspecified vulnerabilities (CVE-2019-2535, CVE-2019-2623, CVE-2019-2683, CVE-2019-2752)

• mysql: Server: Packaging unspecified vulnerability (CVE-2019-2536)

• mysql: Server: Connection unspecified vulnerability (CVE-2019-2539)

• mysql: Server: Information Schema unspecified vulnerability (CVE-2019-2631)

• mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2019-2636)

• mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2019-2691, CVE-2019-2826)

• mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2019-2737)

• mysql: Server: XML unspecified vulnerability (CVE-2019-2740)

• mysql: Server: Components / Services unspecified vulnerability (CVE-2019-2780)

• mysql: Server: DML unspecified vulnerability (CVE-2019-2784)

• mysql: Server: Charsets unspecified vulnerability (CVE-2019-2795)

• mysql: Client programs unspecified vulnerability (CVE-2019-2797)

• mysql: Server: FTS unspecified vulnerability (CVE-2019-2801)

• mysql: Server: Security: Audit unspecified vulnerability (CVE-2019-2819)

• mysql: Server: Compiling unspecified vulnerability (CVE-2019-2738)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.17), galera (25.3.26). (BZ#1701687, BZ#1711265, BZ#1741358)

Security Fix(es):

• mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510)

• mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2537)

• mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

• mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

• mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

• mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

• mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

• mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

• mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld, and many client programs.

The following packages have been upgraded to a later upstream version: mysql (8.0.17).

Security Fix(es):

• mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2800, CVE-2019-2436, CVE-2019-2531, CVE-2019-2534, CVE-2019-2614, CVE-2019-2617, CVE-2019-2630, CVE-2019-2634, CVE-2019-2635, CVE-2019-2755)

• mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2420, CVE-2019-2481, CVE-2019-2507, CVE-2019-2529, CVE-2019-2530, CVE-2019-2581, CVE-2019-2596, CVE-2019-2607, CVE-2019-2625, CVE-2019-2681, CVE-2019-2685, CVE-2019-2686, CVE-2019-2687, CVE-2019-2688, CVE-2019-2689, CVE-2019-2693, CVE-2019-2694, CVE-2019-2695, CVE-2019-2757, CVE-2019-2774, CVE-2019-2796, CVE-2019-2802, CVE-2019-2803, CVE-2019-2808, CVE-2019-2810, CVE-2019-2812, CVE-2019-2815, CVE-2019-2830, CVE-2019-2834)

• mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-2434, CVE-2019-2455, CVE-2019-2805)

• mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2482, CVE-2019-2592)

• mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2019-2486, CVE-2019-2532, CVE-2019-2533, CVE-2019-2584, CVE-2019-2589, CVE-2019-2606, CVE-2019-2620, CVE-2019-2627, CVE-2019-2739, CVE-2019-2778, CVE-2019-2811, CVE-2019-2789)

• mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2494, CVE-2019-2495, CVE-2019-2537, CVE-2019-2626, CVE-2019-2644)

• mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2502, CVE-2019-2510, CVE-2019-2580, CVE-2019-2585, CVE-2019-2593, CVE-2019-2624, CVE-2019-2628, CVE-2019-2758, CVE-2019-2785, CVE-2019-2798, CVE-2019-2879, CVE-2019-2814)

• mysql: Server: Connection Handling unspecified vulnerability (CVE-2019-2503)

• mysql: Server: Partition multiple unspecified vulnerabilities (CVE-2019-2528, CVE-2019-2587)

• mysql: Server: Options multiple unspecified vulnerabilities (CVE-2019-2535, CVE-2019-2623, CVE-2019-2683, CVE-2019-2752)

• mysql: Server: Packaging unspecified vulnerability (CVE-2019-2536)

• mysql: Server: Connection unspecified vulnerability (CVE-2019-2539)

• mysql: Server: Information Schema unspecified vulnerability (CVE-2019-2631)

• mysql: Server: Group Replication Plugin unspecified vulnerability (CVE-2019-2636)

• mysql: Server: Security: Roles multiple unspecified vulnerabilities (CVE-2019-2691, CVE-2019-2826)

• mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2019-2737)

• mysql: Server: XML unspecified vulnerability (CVE-2019-2740)

• mysql: Server: Components / Services unspecified vulnerability (CVE-2019-2780)

• mysql: Server: DML unspecified vulnerability (CVE-2019-2784)

• mysql: Server: Charsets unspecified vulnerability (CVE-2019-2795)

• mysql: Client programs unspecified vulnerability (CVE-2019-2797)

• mysql: Server: FTS unspecified vulnerability (CVE-2019-2801)

• mysql: Server: Security: Audit unspecified vulnerability (CVE-2019-2819)

• mysql: Server: Compiling unspecified vulnerability (CVE-2019-2738)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

The following packages have been upgraded to a later upstream version: mariadb (10.3.17), galera (25.3.26). (BZ#1701687, BZ#1711265, BZ#1741358)

Security Fix(es):

• mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510)

• mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2537)

• mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

• mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

• mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

• mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

• mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

• mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

• mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

• mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Updated mariadb packages fix security vulnerabilities:

An easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise mariadb server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) (CVE-2019-2737).

An easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where mariadb server executes to compromise mariadb server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of mariadb server as well as unauthorized update, insert or delete access to some of mariadb server accessible data (CVE-2019-2739).

An easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise mariadb server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of mariadb server (CVE-2019-2740).

An easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise mariadb server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of mariadb server as well as unauthorized update, insert or delete access to some of mariadb server accessible data (CVE-2019-2758).

An easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise mariadb server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of mariadb server (CVE-2019-2805).

This update also fixes issues with FULLTEXT INDEX, Encrypted temporary tables, Indexed virtual columns, Recovery & Mariabackup.

This update for mariadb to version 10.2.29 fixes the following issues:

MariaDB was updated to 10.2.29 (bsc#1156669)

Security issues fixed:

• CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption

This update was imported from the SUSE:SLE-15:Update update project.

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb104 fixes the following issues:

• Implement version 10.4 of MariaDB (jsc#PED-2455):
  • It is possible to use more than one authentication plugin for each user account.
  • The root user account is being created with the ability to use two authentication plugins.
  • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
  • Is being supported for User Password Expiry, which is not active by default.
  • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
• Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
• MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
• Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
• Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)

This update for mariadb fixes the following issues:

Updated to MariaDB 10.0.40-1.

Security issues fixed:

• CVE-2019-2805, CVE-2019-2740, CVE-2019-2739, CVE-2019-2737, CVE-2019-2614, CVE-2019-2627. (bsc#1132826) (bsc#1141798).

Non-security issues fixed:

• Adjusted mysql-systemd-helper ('shutdown protected MySQL' section) so it checks both ping response and the pid in a process list as it can take some time till the process is terminated. Otherwise it can lead to 'found left-over process' situation when regular mariadb is started. (bsc#1143215)
• Fixed IP resolving in mysql_install_db script. (bsc#1142058, bsc#1127027, MDEV-18526)

This update for mariadb-100 fixes the following issues:

Updated to MariaDB 10.0.40-1.

Security issues fixed:

• CVE-2019-2805, CVE-2019-2740, CVE-2019-2739, CVE-2019-2737, CVE-2019-2614, CVE-2019-2627. (bsc#1132826) (bsc#1141798).

This update for mariadb to version 10.2.29 fixes the following issues:

MariaDB was updated to 10.2.29 (bsc#1156669)

Security issues fixed:

• CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption

This update for mariadb to version 10.2.29 fixes the following issues:

MariaDB was updated to 10.2.29 (bsc#1156669)

Security issues fixed:

• CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption

This update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-ironic, openstack-keystone, openstack-monasca-agent, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, openstack-sahara, openstack-trove, python-cinderlm, python-congressclient, python-designateclient, python-ironic-lib, python-networking-cisco, python-osc-lib, python-oslo.context, python-oslo.rootwrap, python-oslo.serialization, python-oslo.service, python-stevedore, python-taskflow, rubygem-crowbar-client, rubygem-puma, venv-openstack-swift fixes the following issues: Security issues fixed:

The update of rubygem-crowbar-client, rubygem-puma fixes the following security issues:

• CVE-2018-17954: Fixed an issue where crowbar was leaking the secret admin passwords to all nodes (bsc#1117080).
• CVE-2019-16770: Fixed a denial-of-service vulnerability that was exploitable by clients sending extraneous keepalive requests (bsc#1158675).

The update of mariadb to 10.2.29 fixes several security issues:

• CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).
• CVE-2019-18901: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).
• CVE-2017-1002201: Fixed an issue where special characters did not escpae properly (bsc#1155089)
• CVE-2019-2737, CVE-2019-2739, CVE-2019-2740, CVE-2019-2758, CVE-2019-2805, CVE-2019-2938, CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service (bsc#1156669)

Non-security issues fixed:

Changes in ardana-cinder:

• Update to version 8.0+git.1579279939.ee7da88:

  • Add option to flatten snapshots when using SES (SOC-11054)

• Update to version 8.0+git.1571846011.1a2f62b:

  • SCRD-4764 move v2.0 endpoints to v3 (SOC-9753)

Changes in ardana-cobbler:

• Update to version 8.0+git.1575037115.0326803:
  • Set root device on SLES autoyast templates (SOC-7365)

Changes in ardana-designate:

• Update to version 8.0+git.1573597788.15b7984:
  • Update gerrit location (SOC-9140)

Changes in ardana-extensions-example:

• Switch to new Gerrit Server

• Update to version 8.0+git.1534266307.db1ec28:

  • SCPL-409 Fix .gitreview for stable/pike

Changes in ardana-extensions-nsx:

• Update to version 8.0+git.1567529036.a41a037:

  • Update policy json templates for vmware-nsx (SOC-10254)

• Switch to new Gerrit Server

Changes in ardana-glance:

• Update to version 8.0+git.1571846045.ab9e3ea:
  • SCRD-4764 move v2.0 endpoints to v3 (SOC-9753)

Changes in ardana-heat:

• Update to version 8.0+git.1571777596.14dce6a:
  • SCRD-4764 remove V2.0 auth end points (SOC-9753)

Changes in ardana-input-model:

• Update to version 8.0+git.1582147997.b9ed134:

  • Enable port security extension neutron (SOC-11027)

• Update to version 8.0+git.1573658751.38e822a:

  • Move manila share to controller (SOC-10938)

Changes in ardana-ironic:

• Update to version 8.0+git.1571845225.006843d:
  • SCRD-4764 remove V2.0 auth end points (SOC-9753)

Changes in ardana-keystone:

• Update to version 8.0+git.1573147067.09e3ea0:
  • enable debug and insecure_debug on demand (SOC-10934)

Changes in ardana-logging:

• Update to version 8.0+git.1572452293.e65d714:
  • use correct Keystone v3 params bsc#1117840 (SOC-9753)

Changes in ardana-monasca:

• Update to version 8.0+git.1572527728.9b34bdf: *…

This update for mariadb to version 10.2.31 GA fixes the following issues:

MariaDB was updated to version 10.2.31 GA (bsc#1162388 and bsc#1156669).

Security issues fixed:

• CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).
• CVE-2019-18901: Fixed an unsafe path handling behavior in mysql-systemd-helper (bsc#1160895).
• CVE-2019-2737: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2938: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2740: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2805: Fixed an issue where could lead a local attacker to cause denial of service
• CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service
• CVE-2019-2758: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• CVE-2019-2739: Fixed an issue where could lead a local attacker to cause denial of service or data corruption
• Enabled security hardenings in MariaDB's systemd service, namely ProtectSystem, ProtectHome and UMask (bsc#1160878).
• Fixed a potental symlink attack (bsc#1160912).
• Fixed a permissions issue in /var/lib/mysql (bsc#1077717).
• Used systemd-tmpfiles for a cleaner and safer creation of /run/mysql (bsc#1160883).

Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues.

Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.04 have been updated to MySQL 5.7.27.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-27.html https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

USN-4070-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for CVE-2019-2737, CVE-2019-2739, CVE-2019-2740, CVE-2019-2805 in MariaDB 10.1.

Ubuntu 18.04 LTS has been updated to MariaDB 10.1.41.

In addition to security fixes, the updated package contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://mariadb.com/kb/en/library/mariadb-10141-changelog/ https://mariadb.com/kb/en/library/mariadb-10141-release-notes/

Original advisory details:

Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues.

Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.04 have been updated to MySQL 5.7.27.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-27.html https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html