openSUSE Security Update: Security update for mariadb
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:1595-1
Rating:             moderate
References:         #1088681 #1089987 #1090518 #1092544 
Cross-References:   CVE-2018-2755 CVE-2018-2759 CVE-2018-2761
                    CVE-2018-2766 CVE-2018-2767 CVE-2018-2771
                    CVE-2018-2777 CVE-2018-2781 CVE-2018-2782
                    CVE-2018-2784 CVE-2018-2786 CVE-2018-2787
                    CVE-2018-2810 CVE-2018-2813 CVE-2018-2817
                    CVE-2018-2819
Affected Products:
                    openSUSE Leap 15.0
______________________________________________________________________________

   An update that fixes 16 vulnerabilities is now available.

Description:

   This update for mariadb to version 10.2.15 fixes the following issues:

   These security issues were fixed:

   - CVE-2018-2767: Enforse use of SSL/TLS in embedded server library (Return
     of BACKRONYM) (bsc#1088681).
   - CVE-2018-2786: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
     high privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server as well as unauthorized update,
     insert or delete access to some of MySQL Server accessible data
     (bsc#1089987).
   - CVE-2018-2759: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
     high privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server (bsc#1089987).
   - CVE-2018-2777: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
     high privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server (bsc#1089987).
   - CVE-2018-2810: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
     high privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server (bsc#1089987).
   - CVE-2018-2782: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
     low privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518).
   - CVE-2018-2784: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
     low privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518).
   - CVE-2018-2787: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
     high privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server as well as unauthorized update,
     insert or delete access to some of MySQL Server accessible data
     (bsc#1089987, bsc#1090518).
   - CVE-2018-2766: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
     high privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518).
   - CVE-2018-2755: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: Server: Replication). Difficult to exploit
     vulnerability allowed unauthenticated attacker with logon to the
     infrastructure where MySQL Server executes to compromise MySQL Server.
     Successful attacks require human interaction from a person other than
     the attacker and while the vulnerability is in MySQL Server, attacks may
     significantly impact additional products. Successful attacks of this
     vulnerability can result in takeover of MySQL Server (bsc#1089987,
     bsc#1090518).
   - CVE-2018-2819: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: InnoDB). Easily exploitable vulnerability allowed
     low privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server (bsc#1089987, bsc#1090518).
   - CVE-2018-2817: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: Server: DDL). Easily exploitable vulnerability
     allowed low privileged attacker with network access via multiple
     protocols to compromise MySQL Server. Successful attacks of this
     vulnerability can result in unauthorized ability to cause a hang or
     frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987,
     bsc#1090518).
   - CVE-2018-2761: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: Client programs). Difficult to exploit
     vulnerability allowed unauthenticated attacker with network access via
     multiple protocols to compromise MySQL Server. Successful attacks of
     this vulnerability can result in unauthorized ability to cause a hang or
     frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987,
     bsc#1090518).
   - CVE-2018-2781: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: Server: Optimizer). Easily exploitable
     vulnerability allowed high privileged attacker with network access via
     multiple protocols to compromise MySQL Server. Successful attacks of
     this vulnerability can result in unauthorized ability to cause a hang or
     frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987,
     bsc#1090518).
   - CVE-2018-2771: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: Server: Locking). Difficult to exploit
     vulnerability allowed high privileged attacker with network access via
     multiple protocols to compromise MySQL Server. Successful attacks of
     this vulnerability can result in unauthorized ability to cause a hang or
     frequently repeatable crash (complete DOS) of MySQL Server (bsc#1089987,
     bsc#1090518).
   - CVE-2018-2813: Vulnerability in the MySQL Server component of Oracle
     MySQL (subcomponent: Server: DDL). Easily exploitable vulnerability
     allowed low privileged attacker with network access via multiple
     protocols to compromise MySQL Server. Successful attacks of this
     vulnerability can result in unauthorized read access to a subset of
     MySQL Server accessible data (bsc#1089987, bsc#1090518).

   These non-security issues were fixed:

   - PCRE updated to 8.42
   - Incomplete validation of missing tablespace during recovery
   - ib_buffer_pool unnecessarily includes the temporary tablespace
   - InnoDB may write uninitialized garbage to redo log
   - Virtual Columns: Assertion failed in dict_table_get_col_name
   - slow innodb startup/shutdown can exceed systemd timeout
   - Assertion failed in dict_check_sys_tables on upgrade from 5.5
   - Change buffer crash during TRUNCATE or DROP TABLE
   - temporary table ROLLBACK fixes

   For additional details please see

   - https://mariadb.com/kb/en/library/mariadb-10215-release-notes
   - https://mariadb.com/kb/en/library/mariadb-10215-changelog


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended
 installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.0:

      zypper in -t patch openSUSE-2018-572=1



Package List:

   - openSUSE Leap 15.0 (i586 x86_64):

      libmysqld-devel-10.2.15-lp150.2.3.2
      libmysqld19-10.2.15-lp150.2.3.2
      libmysqld19-debuginfo-10.2.15-lp150.2.3.2
      mariadb-10.2.15-lp150.2.3.2
      mariadb-bench-10.2.15-lp150.2.3.2
      mariadb-bench-debuginfo-10.2.15-lp150.2.3.2
      mariadb-client-10.2.15-lp150.2.3.2
      mariadb-client-debuginfo-10.2.15-lp150.2.3.2
      mariadb-debuginfo-10.2.15-lp150.2.3.2
      mariadb-debugsource-10.2.15-lp150.2.3.2
      mariadb-galera-10.2.15-lp150.2.3.2
      mariadb-test-10.2.15-lp150.2.3.2
      mariadb-test-debuginfo-10.2.15-lp150.2.3.2
      mariadb-tools-10.2.15-lp150.2.3.2
      mariadb-tools-debuginfo-10.2.15-lp150.2.3.2

   - openSUSE Leap 15.0 (noarch):

      mariadb-errormessages-10.2.15-lp150.2.3.2


References:

   https://www.suse.com/security/cve/CVE-2018-2755.html
   https://www.suse.com/security/cve/CVE-2018-2759.html
   https://www.suse.com/security/cve/CVE-2018-2761.html
   https://www.suse.com/security/cve/CVE-2018-2766.html
   https://www.suse.com/security/cve/CVE-2018-2767.html
   https://www.suse.com/security/cve/CVE-2018-2771.html
   https://www.suse.com/security/cve/CVE-2018-2777.html
   https://www.suse.com/security/cve/CVE-2018-2781.html
   https://www.suse.com/security/cve/CVE-2018-2782.html
   https://www.suse.com/security/cve/CVE-2018-2784.html
   https://www.suse.com/security/cve/CVE-2018-2786.html
   https://www.suse.com/security/cve/CVE-2018-2787.html
   https://www.suse.com/security/cve/CVE-2018-2810.html
   https://www.suse.com/security/cve/CVE-2018-2813.html
   https://www.suse.com/security/cve/CVE-2018-2817.html
   https://www.suse.com/security/cve/CVE-2018-2819.html
   https://bugzilla.suse.com/1088681
   https://bugzilla.suse.com/1089987
   https://bugzilla.suse.com/1090518
   https://bugzilla.suse.com/1092544

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org