SB2019020602 - OpenSUSE Linux update for mysql-community-server
Published: February 6, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2018-0734)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists due to unspecified flaw in Digital Signature Algorithm (DSA). A local attacker can conduct a timing side-channel attack and recover the private key, which could be used to conduct further attacks.
2) Denial of service (CVE-ID: CVE-2019-2455)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote authenticated attacker to cause DoS condition.
The weakness exists in MySQL Protocol due to unspecified flaw. A remote attacker can cause the service to crash.
3) Denial of service (CVE-ID: CVE-2019-2481)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote authenticated high-privileged attacker to cause DoS condition.
The weakness exists in MySQL Protocol due to unspecified flaw. A remote attacker can cause the service to crash.
4) Denial of service (CVE-ID: CVE-2019-2482)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote authenticated attacker to cause DoS condition.
The weakness exists in MySQL Protocol due to unspecified flaw. A remote attacker can cause the service to crash.
5) Security restrictions bypass (CVE-ID: CVE-2019-2503)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows an adjacent authenticated attacker to bypass security restrictions.
The weakness exists in MySQL Protocol due to unspecified flaw. An adjacent attacker can bypass security restrictions to read potentially sensitive information and cause the service to crash.
6) Denial of service (CVE-ID: CVE-2019-2507)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote authenticated high-privileged attacker to cause DoS condition.
The weakness exists in MySQL Protocol due to unspecified flaw. A remote attacker can cause the service to crash.
7) Denial of service (CVE-ID: CVE-2019-2529)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote authenticated attacker to cause DoS condition.
The weakness exists in MySQL Protocol due to unspecified flaw. A remote attacker can cause the service to crash.
8) Denial of service (CVE-ID: CVE-2019-2531)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote authenticated high-privileged attacker to cause DoS condition.
The weakness exists in MySQL Protocol due to unspecified flaw. A remote attacker can cause the service to crash.
9) Security restrictions bypass (CVE-ID: CVE-2019-2534)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote authenticated attacker to bypass security restrictions.
The weakness exists in MySQL Protocol due to unspecified flaw. A remote attacker can bypass security restrictions to read potentially sensitive information and modify arbitrary data.
10) Denial of service (CVE-ID: CVE-2019-2537)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote authenticated high-privileged attacker to cause DoS condition.
The weakness exists in MySQL Protocol due to unspecified flaw. A remote attacker can cause the service to crash.
Remediation
Install update from vendor's website.