SUSE update for mariadb



Risk Medium
Patch available YES
Number of vulnerabilities 37
CVE-ID CVE-2021-46657
CVE-2021-46658
CVE-2021-46659
CVE-2021-46661
CVE-2021-46663
CVE-2021-46664
CVE-2021-46665
CVE-2021-46668
CVE-2021-46669
CVE-2022-21427
CVE-2022-24048
CVE-2022-24050
CVE-2022-24051
CVE-2022-24052
CVE-2022-27376
CVE-2022-27377
CVE-2022-27378
CVE-2022-27379
CVE-2022-27380
CVE-2022-27381
CVE-2022-27382
CVE-2022-27383
CVE-2022-27384
CVE-2022-27386
CVE-2022-27387
CVE-2022-27444
CVE-2022-27445
CVE-2022-27446
CVE-2022-27447
CVE-2022-27448
CVE-2022-27449
CVE-2022-27451
CVE-2022-27452
CVE-2022-27455
CVE-2022-27456
CVE-2022-27457
CVE-2022-27458
CWE-ID CWE-400
CWE-399
CWE-20
CWE-476
CWE-416
CWE-119
CWE-134
CWE-122
CWE-89
CWE-120
Exploitation vector Network
Public exploit N/A
Vulnerable software
 SUSE Manager Retail Branch Server
Operating systems & Components / Operating system

SUSE Manager Server
Operating systems & Components / Operating system

SUSE Manager Proxy
Operating systems & Components / Operating system

SUSE Linux Enterprise Server
Operating systems & Components / Operating system

SUSE Linux Enterprise Module for Server Applications
Operating systems & Components / Operating system

openSUSE Leap
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing
Operating systems & Components / Operating system

mariadb-errormessages
Operating systems & Components / Operating system package or component

mariadb-tools-debuginfo
Operating systems & Components / Operating system package or component

mariadb-tools
Operating systems & Components / Operating system package or component

mariadb-test-debuginfo
Operating systems & Components / Operating system package or component

mariadb-test
Operating systems & Components / Operating system package or component

mariadb-rpm-macros
Operating systems & Components / Operating system package or component

mariadb-galera
Operating systems & Components / Operating system package or component

mariadb-debugsource
Operating systems & Components / Operating system package or component

mariadb-debuginfo
Operating systems & Components / Operating system package or component

mariadb-client-debuginfo
Operating systems & Components / Operating system package or component

mariadb-client
Operating systems & Components / Operating system package or component

mariadb-bench-debuginfo
Operating systems & Components / Operating system package or component

mariadb-bench
Operating systems & Components / Operating system package or component

mariadb
Operating systems & Components / Operating system package or component

libmariadbd19-debuginfo
Operating systems & Components / Operating system package or component

libmariadbd19
Operating systems & Components / Operating system package or component

libmariadbd-devel
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 37 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU63849

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46657

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing certain subquery uses of ORDER BY. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU63852

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46658

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of with_window_func=true for a subquery. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU60556

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46659

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. The database does not recognize that SELECT_LEX::nest_level is local to each VIEW. A remote user execute a specially crafted statements and perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU63672

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46661

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE). A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU63671

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46663

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to ha_maria::extra application crash via certain SELECT statements. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU63717

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46664

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the sub_select_postjoin_aggr() function. A remote user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU63719

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46665

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect used_tables expectations in the sql_parse.cc. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource exhaustion

EUVDB-ID: #VU60557

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46668

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote user can trigger resource exhaustion via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU63827

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46669

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in the convert_const_to_int() function when processing BIGINT data type. A remote attacker can trigger use-after-free error and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper input validation

EUVDB-ID: #VU62418

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21427

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: FTS component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU60555

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24048

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the storage engine when processing CONNECT queries. A remote authenticated user can send a specially crafted SQL query to the affected database instance, trigger a memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU60554

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24050

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the storage engine when processing CONNECT queries. A remote user can send a specially crafted SQL query to the database instance, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Format string error

EUVDB-ID: #VU60552

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24051

CWE-ID: CWE-134 - Use of Externally-Controlled Format String

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a format string error in the CONNECT function implementation. A remote user with access to database can send a specially crafted SQL query that contains format string specifiers and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Heap-based buffer overflow

EUVDB-ID: #VU60553

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24052

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the storage engine when processing CONNECT requests. A remote user can send a specially crafted SQL query to the database instance, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Use-after-free

EUVDB-ID: #VU63507

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27376

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in the Item_args::walk_arg() function. A remote user can pass specially crafted SQL statements and cause a denial of service.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Use-after-free

EUVDB-ID: #VU63508

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27377

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in the Item_func_in::cleanup() function. A remote user can pass specially crafted SQL statements and cause a denial of service.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) SQL injection

EUVDB-ID: #VU63510

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27378

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Create_tmp_table::finalize() function. A remote user can send specially crafted SQL statements to the affected application and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) SQL injection

EUVDB-ID: #VU63512

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27379

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Arg_comparator::compare_real() function. A remote user can send specially crafted SQL statements to the affected application and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) SQL injection

EUVDB-ID: #VU63514

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27380

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to insufficient sanitization of user-supplied data in the my_decimal::operator=() function. A remote user can send specially crafted SQL statements to the affected application and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) SQL injection

EUVDB-ID: #VU63515

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27381

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Field::set_default() function. A remote user can send specially crafted SQL statements to the affected application and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU63516

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27382

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a segmentation fault via the Item_field::used_tables/update_depend_map_for_order() function. A remote user can send specially crafted data and perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Use-after-free

EUVDB-ID: #VU63517

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27383

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in the my_strcasecmp_8bit component. A remote user can pass specially crafted SQL statements and cause a denial of service.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) SQL injection

EUVDB-ID: #VU63519

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27384

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Item_subselect::init_expr_cache_tracker() function. A remote user can send specially crafted SQL statements to the affected application and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Buffer overflow

EUVDB-ID: #VU63520

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27386

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to segmentation fault via the sql/sql_class.cc component. A remote user can send specially crafted data and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Buffer overflow

EUVDB-ID: #VU63521

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27387

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to buffer overflow error in the decimal_bin_size component. A remote user can send specially crafted SQL statements to the affected application, trigger buffer overflow error and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Buffer overflow

EUVDB-ID: #VU63523

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27444

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to segmentation fault via the sql/item_subselect.cc component. A remote user can send specially crafted data and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Buffer overflow

EUVDB-ID: #VU63525

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27445

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to segmentation fault via the sql/sql_window.cc component. A remote user can send specially crafted data and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Buffer overflow

EUVDB-ID: #VU63526

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27446

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to segmentation fault via the sql/item_cmpfunc.h component. A remote user can send specially crafted data and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Use-after-free

EUVDB-ID: #VU63529

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27447

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to use-after-free error via the Binary_string::free_buffer() function in the /sql/sql_string.h component. A remote user can send specially crafted data and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Buffer overflow

EUVDB-ID: #VU63531

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27448

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a buffer overflow in the BTR_PCUR_ON() function in the /row/row0mysql.cc component. A remote user can send a specially crafted data and perform a denial of service (DoS) attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Buffer overflow

EUVDB-ID: #VU63532

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27449

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to segmentation fault via the sql/item_func.cc:148 component. A remote user can send specially crafted data and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Buffer overflow

EUVDB-ID: #VU63534

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27451

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to segmentation fault via the sql/field_conv.cc component. A remote user can send specially crafted data and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Buffer overflow

EUVDB-ID: #VU63536

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27452

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to segmentation fault via the sql/item_cmpfunc.cc component. A remote user can send specially crafted data and perform a denial of service attack.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Use-after-free

EUVDB-ID: #VU63538

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27455

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in the my_wildcmp_8bit_impl component at /strings/ctype-simple.c. A remote user can pass specially crafted data and cause a denial of service.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Use-after-free

EUVDB-ID: #VU63540

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27456

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in the VDec::VDec() function at /sql/sql_type.cc. A remote user can pass specially crafted data and cause a denial of service.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU63543

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27457

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in the my_mb_wc_latin1 component in the /strings/ctype-latin1.c. A remote user can pass specially crafted data and cause a denial of service.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Use-after-free

EUVDB-ID: #VU63545

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27458

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in the Binary_string::free_buffer() function at /sql/sql_string.h. A remote user can pass specially crafted data and cause a denial of service.

Mitigation

Update the affected package mariadb to the latest version.

Vulnerable software versions

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

SUSE Linux Enterprise Module for Server Applications: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

mariadb-errormessages: before 10.6.8-150400.3.7.1

mariadb-tools-debuginfo: before 10.6.8-150400.3.7.1

mariadb-tools: before 10.6.8-150400.3.7.1

mariadb-test-debuginfo: before 10.6.8-150400.3.7.1

mariadb-test: before 10.6.8-150400.3.7.1

mariadb-rpm-macros: before 10.6.8-150400.3.7.1

mariadb-galera: before 10.6.8-150400.3.7.1

mariadb-debugsource: before 10.6.8-150400.3.7.1

mariadb-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client-debuginfo: before 10.6.8-150400.3.7.1

mariadb-client: before 10.6.8-150400.3.7.1

mariadb-bench-debuginfo: before 10.6.8-150400.3.7.1

mariadb-bench: before 10.6.8-150400.3.7.1

mariadb: before 10.6.8-150400.3.7.1

libmariadbd19-debuginfo: before 10.6.8-150400.3.7.1

libmariadbd19: before 10.6.8-150400.3.7.1

libmariadbd-devel: before 10.6.8-150400.3.7.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222561-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###