{"id":"CVE-2023-52968","aliases":["BELL-CVE-2023-52968","BIT-mariadb-2023-52968","BIT-mariadb-min-2023-52968","BIT-mysql-client-2023-52968","DEBIAN-CVE-2023-52968","EUVD-2023-59686","GHSA-7c2c-wp2q-q5vx","UBUNTU-CVE-2023-52968"],"status":"published","title":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11...","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00454,"percentile":0.39822,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-696"],"published":"2025-03-08T00:00:00Z","modified":"2026-11-05T11:45:15Z","fixes":[{"ecosystem":"Alpaquita:23","package":"mariadb","fixed_in":["10.6.21-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"mariadb","fixed_in":["10.11.7-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mariadb","fixed_in":["10.4.33","10.5.24","10.6.17","10.11.7","11.0.5","11.1.4"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mariadb-min","fixed_in":["10.4.33","10.5.24","10.6.17","10.11.7","11.0.5","11.1.4"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mysql-client","fixed_in":["10.4.33","10.5.24","10.6.17","10.11.7","11.0.5","11.1.4"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"mariadb-10.5","fixed_in":["1:10.5.26-0+deb11u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.6.12-r0"},{"fixed":"10.6.21-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.11.4-r0"},{"fixed":"10.11.7-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mariadb","ranges":[{"type":"SEMVER","events":[{"introduced":"10.4.0"},{"fixed":"10.4.33"},{"introduced":"10.5.0"},{"fixed":"10.5.24"},{"introduced":"10.6.0"},{"fixed":"10.6.17"},{"introduced":"10.7.0"},{"fixed":"10.11.7"},{"introduced":"11.0.0"},{"fixed":"11.0.5"},{"introduced":"11.1.0"},{"fixed":"11.1.4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mariadb-min","ranges":[{"type":"SEMVER","events":[{"introduced":"10.4.0"},{"fixed":"10.4.33"},{"introduced":"10.5.0"},{"fixed":"10.5.24"},{"introduced":"10.6.0"},{"fixed":"10.6.17"},{"introduced":"10.7.0"},{"fixed":"10.11.7"},{"introduced":"11.0.0"},{"fixed":"11.0.5"},{"introduced":"11.1.0"},{"fixed":"11.1.4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mysql-client","ranges":[{"type":"SEMVER","events":[{"introduced":"10.4.0"},{"fixed":"10.4.33"},{"introduced":"10.5.0"},{"fixed":"10.5.24"},{"introduced":"10.6.0"},{"fixed":"10.6.17"},{"introduced":"10.7.0"},{"fixed":"10.11.7"},{"introduced":"11.0.0"},{"fixed":"11.0.5"},{"introduced":"11.1.0"},{"fixed":"11.1.4"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"mariadb-10.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.5.26-0+deb11u1"}]}],"versions":["1:10.5.11-1","1:10.5.12-0+deb11u1","1:10.5.12-1","1:10.5.13-0+deb11u1","1:10.5.15-0+deb11u1","1:10.5.18-0+deb11u1","1:10.5.19-0+deb11u1","1:10.5.19-0+deb11u2","1:10.5.21-0+deb11u1","1:10.5.23-0+deb11u1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mariadb-10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.20-0ubuntu0.15.04.1","10.0.22-0ubuntu1","10.0.23-1","10.0.23-2","10.0.24-7","10.0.25-0ubuntu0.16.04.1","10.0.27-0ubuntu0.16.04.1","10.0.28-0ubuntu0.16.04.1","10.0.29-0ubuntu0.16.04.1","10.0.31-0ubuntu0.16.04.2","10.0.33-0ubuntu0.16.04.1","10.0.34-0ubuntu0.16.04.1","10.0.36-0ubuntu0.16.04.1","10.0.38-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mariadb-10.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.25-1","1:10.1.29-6","1:10.1.34-0ubuntu0.18.04.1","1:10.1.38-0ubuntu0.18.04.1","1:10.1.38-0ubuntu0.18.04.2","1:10.1.40-0ubuntu0.18.04.1","1:10.1.41-0ubuntu0.18.04.1","1:10.1.43-0ubuntu0.18.04.1","1:10.1.44-0ubuntu0.18.04.1","1:10.1.47-0ubuntu0.18.04.1","1:10.1.48-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mariadb-10.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.3.17-1","1:10.3.18-1","1:10.3.19-1","1:10.3.21-2","1:10.3.22-1","1:10.3.22-1ubuntu1","1:10.3.25-0ubuntu0.20.04.1","1:10.3.29-0ubuntu0.20.04.1","1:10.3.30-0ubuntu0.20.04.1","1:10.3.31-0ubuntu0.20.04.1","1:10.3.32-0ubuntu0.20.04.1","1:10.3.34-0ubuntu0.20.04.1","1:10.3.37-0ubuntu0.20.04.1","1:10.3.38-0ubuntu0.20.04.1","1:10.3.39-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.11.4-1","1:10.11.5-3","1:10.11.6-1","1:10.11.6-2","1:10.11.7-2ubuntu1","1:10.11.7-2ubuntu2","1:10.11.8-0ubuntu0.24.04.1","1:10.11.11-0ubuntu0.24.04.2","1:10.11.13-0ubuntu0.24.04.1","1:10.11.14-0ubuntu0.24.04.1"]}],"products":[{"vendor":"mariadb","product":"mariadb"}],"references":[{"url":"https://jira.mariadb.org/browse/MDEV-32082","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7c2c-wp2q-q5vx"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-52968","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-52968","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-52968","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52968","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-03-08T00:00:00Z","modified":"2025-03-10T15:59:46.152Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-696"],"updated_at":"2026-11-02T14:35:18.88314Z"}],"euvd":[{"id":"EUVD-2023-59686","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-03-08T00:00:00Z","modified":"2025-03-10T15:59:46Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:53:09.715484Z"}],"ghsa":[{"id":"GHSA-7c2c-wp2q-q5vx","title":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11...","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-03-09T00:30:52Z","modified":"2025-03-09T00:30:57Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-696"],"updated_at":"2026-11-02T15:00:11.427911Z"}],"nvd":[{"id":"CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-03-08T23:15:13.173Z","modified":"2026-06-17T06:44:01.073Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-696"],"updated_at":"2026-11-02T14:09:20.080574Z"}],"osv":[{"id":"BELL-CVE-2023-52968","status":"published","published":"2025-03-11T05:57:17.228318Z","modified":"2026-01-26T09:35:36.25811Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:18.478155Z"},{"id":"DEBIAN-CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-03-08T23:15:13.173Z","modified":"2026-08-27T23:04:56.712906341Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.889463Z"},{"id":"UBUNTU-CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-03-08T23:15:00Z","modified":"2026-11-05T11:45:15.095977358Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"BIT-mariadb-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-03-13T07:14:21.149Z","modified":"2025-06-10T12:59:22.290516Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mariadb-min-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-06-10T11:52:12.157Z","modified":"2025-06-10T12:59:22.290516Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mysql-client-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-03-13T07:16:09.35Z","modified":"2025-06-10T12:59:22.290516Z","updated_at":"2026-11-02T15:28:33.469426Z"},{"id":"CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash.","status":"published","published":"2025-03-08T23:15:13Z","modified":"2026-04-10T05:06:46.650544Z","updated_at":"2026-11-02T15:44:35.70651Z"}]}}