Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-27458 (GCVE-0-2022-27458)
Vulnerability from cvelistv5 – Published: – Updated: 2024-05-01 21:46
VLAI?
EPSS
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-27447. Reason: This candidate is a reservation duplicate of CVE-2022-27447. Notes: All CVE users should reference CVE-2022-27447 instead of this candidate.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2024-05-01T21:46:11.634Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-27447. Reason: This candidate is a reservation duplicate of CVE-2022-27447. Notes: All CVE users should reference CVE-2022-27447 instead of this candidate."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-27458",
"dateRejected": "2024-05-01T00:00:00.000Z",
"dateReserved": "2022-03-21T00:00:00.000Z",
"dateUpdated": "2024-05-01T21:46:11.634Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.0"
}
FKIE_CVE-2022-27458
Vulnerability from fkie_nvd - Published: 2022-04-14 13:15 - Updated: 2024-05-01 22:15
Severity ?
Summary
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-27447. Reason: This candidate is a reservation duplicate of CVE-2022-27447. Notes: All CVE users should reference CVE-2022-27447 instead of this candidate.
References
| URL | Tags |
|---|
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-27447. Reason: This candidate is a reservation duplicate of CVE-2022-27447. Notes: All CVE users should reference CVE-2022-27447 instead of this candidate."
}
],
"id": "CVE-2022-27458",
"lastModified": "2024-05-01T22:15:09.480",
"metrics": {},
"published": "2022-04-14T13:15:12.223",
"references": [],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Rejected"
}
GHSA-MQ95-27MR-XGRH
Vulnerability from github – Published: 2022-04-15 00:00 – Updated: 2024-05-02 00:30
VLAI?
Details
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.
Severity ?
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-27458"
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-14T13:15:00Z",
"severity": "HIGH"
},
"details": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.",
"id": "GHSA-mq95-27mr-xgrh",
"modified": "2024-05-02T00:30:47Z",
"published": "2022-04-15T00:00:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27458"
},
{
"type": "WEB",
"url": "https://jira.mariadb.org/browse/MDEV-28099"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220526-0007"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
CVE-2022-27458
Vulnerability from osv_almalinux
Published
2022-08-09 00:00
Modified
2022-08-10 07:03
Summary
Moderate: galera, mariadb, and mysql-selinux security, bug fix, and enhancement update
Details
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb (10.5.16), mysql-selinux (1.0.5). Security Fix(es): * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669) * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048) * mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050) * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051) * mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVE-2022-24052) * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376) * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377) * mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378) * mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379) * mariadb: server crash at my_decimal::operator= (CVE-2022-27380) * mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381) * mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382) * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383) * mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384) * mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386) * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387) * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444) * mariadb: assertion failure in compare_order_elements (CVE-2022-27445) * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447) * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448) * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449) * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451) * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452) * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455) * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456) * mariadb: incorrect key in "dup value" error after long unique (CVE-2022-27457) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623) * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659) * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661) * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663) * mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664) * mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665) * mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-backup"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-embedded-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-errmsg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-gssapi-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-oqgraph-engine"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-pam"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-server-galera"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-server-utils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "mariadb-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.el9_0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. \nThe following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb (10.5.16), mysql-selinux (1.0.5).\nSecurity Fix(es):\n* mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669)\n* mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048)\n* mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050)\n* mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051)\n* mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVE-2022-24052)\n* mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)\n* mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)\n* mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378)\n* mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379)\n* mariadb: server crash at my_decimal::operator= (CVE-2022-27380)\n* mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)\n* mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382)\n* mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)\n* mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384)\n* mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)\n* mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)\n* mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444)\n* mariadb: assertion failure in compare_order_elements (CVE-2022-27445)\n* mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446)\n* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)\n* mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)\n* mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)\n* mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451)\n* mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)\n* mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455)\n* mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)\n* mariadb: incorrect key in \"dup value\" error after long unique (CVE-2022-27457)\n* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)\n* mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622)\n* mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623)\n* mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)\n* mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661)\n* mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663)\n* mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664)\n* mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665)\n* mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "ALSA-2022:5948",
"modified": "2022-08-10T07:03:13Z",
"published": "2022-08-09T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2022:5948"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46659"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46661"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46663"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46664"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46665"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46668"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46669"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24048"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24050"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24051"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24052"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27376"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27377"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27378"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27379"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27380"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27381"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27382"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27383"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27384"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27386"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27387"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27444"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27445"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27446"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27447"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27448"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27449"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27451"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27452"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27455"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27456"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27457"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27458"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-31622"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-31623"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2049302"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050017"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050022"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050024"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050026"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050032"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050034"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2068211"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2068233"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2068234"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2069833"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074817"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074947"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074949"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074951"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074966"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074981"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074987"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074996"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074999"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075005"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075006"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075691"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075692"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075693"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075694"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075695"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075696"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075697"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075699"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075700"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075701"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2076144"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2076145"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2092354"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2092360"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2022-5948.html"
}
],
"related": [
"CVE-2021-46669",
"CVE-2022-24048",
"CVE-2022-24050",
"CVE-2022-24051",
"CVE-2022-24052",
"CVE-2022-27376",
"CVE-2022-27377",
"CVE-2022-27378",
"CVE-2022-27379",
"CVE-2022-27380",
"CVE-2022-27381",
"CVE-2022-27382",
"CVE-2022-27383",
"CVE-2022-27384",
"CVE-2022-27386",
"CVE-2022-27387",
"CVE-2022-27444",
"CVE-2022-27445",
"CVE-2022-27446",
"CVE-2022-27447",
"CVE-2022-27448",
"CVE-2022-27449",
"CVE-2022-27451",
"CVE-2022-27452",
"CVE-2022-27455",
"CVE-2022-27456",
"CVE-2022-27457",
"CVE-2022-27458",
"CVE-2022-31622",
"CVE-2022-31623",
"CVE-2021-46659",
"CVE-2021-46661",
"CVE-2021-46663",
"CVE-2021-46664",
"CVE-2021-46665",
"CVE-2021-46668"
],
"summary": "Moderate: galera, mariadb, and mysql-selinux security, bug fix, and enhancement update"
}
CVE-2022-27458
Vulnerability from osv_almalinux
Published
2022-08-02 00:00
Modified
2022-08-05 15:41
Summary
Moderate: mariadb:10.5 security, bug fix, and enhancement update
Details
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb (10.5.16). Security Fix(es): * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669) * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048) * mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050) * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051) * mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVE-2022-24052) * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376) * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377) * mariadb: crash in create_tmp_table::finalize (CVE-2022-27378) * mariadb: crash in component arg_comparator::compare_real_fixed (CVE-2022-27379) * mariadb: crash at my_decimal::operator= (CVE-2022-27380) * mariadb: crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381) * mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382) * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383) * mariadb: via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384) * mariadb: crash in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386) * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387) * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444) * mariadb: assertion failure in compare_order_elements (CVE-2022-27445) * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447) * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448) * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449) * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451) * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452) * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455) * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456) * mariadb: incorrect key in "dup value" error after long unique (CVE-2022-27457) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623) * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659) * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661) * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663) * mariadb: crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664) * mariadb: crash because of incorrect used_tables expectations (CVE-2021-46665) * mariadb: crash via certain long SELECT DISTINCT statements (CVE-2021-46668) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Don't use less parallelism if not necessary (BZ#2096934) * Links in galera package description are bad (BZ#2096935) * [Tracker] Rebase to Galera 26.4.11 (BZ#2096936)
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "Judy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.5-18.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "galera"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.4.11-1.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-backup"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-embedded-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-errmsg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-gssapi-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-oqgraph-engine"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-pam"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-server-galera"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-server-utils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.5.16-2.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.\nThe following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb (10.5.16).\nSecurity Fix(es):\n* mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669)\n* mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048)\n* mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050)\n* mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051)\n* mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVE-2022-24052)\n* mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)\n* mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)\n* mariadb: crash in create_tmp_table::finalize (CVE-2022-27378)\n* mariadb: crash in component arg_comparator::compare_real_fixed (CVE-2022-27379)\n* mariadb: crash at my_decimal::operator= (CVE-2022-27380)\n* mariadb: crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)\n* mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382)\n* mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)\n* mariadb: via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384)\n* mariadb: crash in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)\n* mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)\n* mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444)\n* mariadb: assertion failure in compare_order_elements (CVE-2022-27445)\n* mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446)\n* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)\n* mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)\n* mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)\n* mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451)\n* mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)\n* mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455)\n* mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)\n* mariadb: incorrect key in \"dup value\" error after long unique (CVE-2022-27457)\n* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)\n* mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622)\n* mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623)\n* mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)\n* mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661)\n* mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663)\n* mariadb: crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664)\n* mariadb: crash because of incorrect used_tables expectations (CVE-2021-46665)\n* mariadb: crash via certain long SELECT DISTINCT statements (CVE-2021-46668)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\nBug Fix(es):\n* Don\u0027t use less parallelism if not necessary (BZ#2096934)\n* Links in galera package description are bad (BZ#2096935)\n* [Tracker] Rebase to Galera 26.4.11 (BZ#2096936)",
"id": "ALSA-2022:5826",
"modified": "2022-08-05T15:41:21Z",
"published": "2022-08-02T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2022:5826"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46659"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46661"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46663"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46664"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46665"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46668"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46669"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24048"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24050"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24051"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24052"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27376"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27377"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27378"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27379"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27380"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27381"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27382"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27383"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27384"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27386"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27387"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27444"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27445"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27446"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27447"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27448"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27449"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27451"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27452"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27455"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27456"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27457"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27458"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-31622"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-31623"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2049302"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050017"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050022"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050024"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050026"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050032"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050034"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2068211"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2068233"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2068234"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2069833"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074817"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074947"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074949"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074951"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074966"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074981"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074987"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074996"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074999"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075005"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075006"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075691"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075692"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075693"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075694"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075695"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075696"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075697"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075699"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075700"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075701"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2076144"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2076145"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2092354"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2092360"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2022-5826.html"
}
],
"related": [
"CVE-2021-46669",
"CVE-2022-24048",
"CVE-2022-24050",
"CVE-2022-24051",
"CVE-2022-24052",
"CVE-2022-27376",
"CVE-2022-27377",
"CVE-2022-27378",
"CVE-2022-27379",
"CVE-2022-27380",
"CVE-2022-27381",
"CVE-2022-27382",
"CVE-2022-27383",
"CVE-2022-27384",
"CVE-2022-27386",
"CVE-2022-27387",
"CVE-2022-27444",
"CVE-2022-27445",
"CVE-2022-27446",
"CVE-2022-27447",
"CVE-2022-27448",
"CVE-2022-27449",
"CVE-2022-27451",
"CVE-2022-27452",
"CVE-2022-27455",
"CVE-2022-27456",
"CVE-2022-27457",
"CVE-2022-27458",
"CVE-2022-31622",
"CVE-2022-31623",
"CVE-2021-46659",
"CVE-2021-46661",
"CVE-2021-46663",
"CVE-2021-46664",
"CVE-2021-46665",
"CVE-2021-46668"
],
"summary": "Moderate: mariadb:10.5 security, bug fix, and enhancement update"
}
CVE-2022-27458
Vulnerability from osv_almalinux
Published
2022-09-13 00:00
Modified
2022-10-14 07:41
Summary
Moderate: mariadb:10.3 security and bug fix update
Details
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.
The following packages have been upgraded to a later upstream version: mariadb (10.3.35), galera (25.3.35).
Security Fix(es):
- mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669)
- mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427)
- mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048)
- mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050)
- mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051)
- mariadb: CONNECT storage engine heap-based buffer overflow (CVE-2022-24052)
- mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)
- mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)
- mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378)
- mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379)
- mariadb: server crash at my_decimal::operator= (CVE-2022-27380)
- mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)
- mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)
- mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384)
- mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)
- mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)
- mariadb: assertion failure in compare_order_elements (CVE-2022-27445)
- mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)
- mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)
- mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)
- mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)
- mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)
- mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)
- mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622)
- mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623)
- mariadb: server crash at Item_subselect::init_expr_cache_tracker (CVE-2022-32083)
- mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor (CVE-2022-32085)
- mariadb: server crash in Item_args::walk_args (CVE-2022-32087)
- mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (CVE-2022-32088)
- mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)
- mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661)
- mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663)
- mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664)
- mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665)
- mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- [Tracker] Rebase to Galera 25.3.35 for MariaDB-10.3 (BZ#2107075)
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "Judy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.5-18.module_el8.6.0+3139+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "Judy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.5-18.module_el8.6.0+3072+3c630e87"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "galera"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "25.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-backup"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-embedded-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-errmsg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-gssapi-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-oqgraph-engine"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-server-galera"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-server-utils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mariadb-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3:10.3.35-1.module_el8.6.0+3265+230ed96b"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. \n\nThe following packages have been upgraded to a later upstream version: mariadb (10.3.35), galera (25.3.35).\n\nSecurity Fix(es):\n\n* mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669)\n* mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427)\n* mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048)\n* mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050)\n* mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051)\n* mariadb: CONNECT storage engine heap-based buffer overflow (CVE-2022-24052)\n* mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)\n* mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)\n* mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378)\n* mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379)\n* mariadb: server crash at my_decimal::operator= (CVE-2022-27380)\n* mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)\n* mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)\n* mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384)\n* mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)\n* mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)\n* mariadb: assertion failure in compare_order_elements (CVE-2022-27445)\n* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)\n* mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)\n* mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)\n* mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)\n* mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)\n* mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)\n* mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622)\n* mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623)\n* mariadb: server crash at Item_subselect::init_expr_cache_tracker (CVE-2022-32083)\n* mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor (CVE-2022-32085)\n* mariadb: server crash in Item_args::walk_args (CVE-2022-32087)\n* mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (CVE-2022-32088)\n* mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)\n* mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661)\n* mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663)\n* mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664)\n* mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665)\n* mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* [Tracker] Rebase to Galera 25.3.35 for MariaDB-10.3 (BZ#2107075)",
"id": "ALSA-2022:6443",
"modified": "2022-10-14T07:41:44Z",
"published": "2022-09-13T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2022:6443"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46659"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46661"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46663"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46664"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46665"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46668"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2021-46669"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-21427"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24048"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24050"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24051"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-24052"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27376"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27377"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27378"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27379"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27380"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27381"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27383"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27384"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27386"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27387"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27445"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27447"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27448"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27449"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27452"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27456"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-27458"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-31622"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-31623"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-32083"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-32085"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-32087"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-32088"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2049302"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050017"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050022"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050024"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050026"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050032"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2050034"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2068211"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2068233"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2068234"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2069833"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074817"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074947"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074949"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074951"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074966"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074981"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074996"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2074999"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075005"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075006"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075691"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075693"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075694"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075695"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075697"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2075700"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2076145"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2082644"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2092354"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2092360"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2104425"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2104431"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2104434"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2106008"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2022-6443.html"
}
],
"related": [
"CVE-2021-46669",
"CVE-2022-21427",
"CVE-2022-24048",
"CVE-2022-24050",
"CVE-2022-24051",
"CVE-2022-24052",
"CVE-2022-27376",
"CVE-2022-27377",
"CVE-2022-27378",
"CVE-2022-27379",
"CVE-2022-27380",
"CVE-2022-27381",
"CVE-2022-27383",
"CVE-2022-27384",
"CVE-2022-27386",
"CVE-2022-27387",
"CVE-2022-27445",
"CVE-2022-27447",
"CVE-2022-27448",
"CVE-2022-27449",
"CVE-2022-27452",
"CVE-2022-27456",
"CVE-2022-27458",
"CVE-2022-31622",
"CVE-2022-31623",
"CVE-2022-32083",
"CVE-2022-32085",
"CVE-2022-32087",
"CVE-2022-32088",
"CVE-2021-46659",
"CVE-2021-46661",
"CVE-2021-46663",
"CVE-2021-46664",
"CVE-2021-46665",
"CVE-2021-46668"
],
"summary": "Moderate: mariadb:10.3 security and bug fix update"
}
CNVD-2022-65002
Vulnerability from cnvd - Published: 2022-09-23
VLAI Severity ?
Title
MariaDB Binary_string::free_buffer()组件内存错误引用漏洞
Description
MariaDB是MariaDB基金会的一套免费开源的数据库管理系统，也是一个采用Maria存储引擎的MySQL分支版本。
MariaDB v10.6.3及更低版本存在内存错误引用漏洞，该漏洞源于/sql/sql_string.h的组件Binary_string::free_buffer()中的释放后重用错误。攻击者可利用此漏洞导致程序崩溃。
Severity
中
Patch Name
MariaDB Binary_string::free_buffer()组件内存错误引用漏洞的补丁
Patch Description
MariaDB是MariaDB基金会的一套免费开源的数据库管理系统，也是一个采用Maria存储引擎的MySQL分支版本。
MariaDB v10.6.3及更低版本存在内存错误引用漏洞，该漏洞源于/sql/sql_string.h的组件Binary_string::free_buffer()中的释放后重用错误。攻击者可利用此漏洞导致程序崩溃。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布了漏洞修复程序，请及时关注更新： https://jira.mariadb.org/browse/MDEV-28099
Reference
https://nvd.nist.gov/vuln/detail/CVE-2022-27458
Impacted products
| Name | MariaDB MariaDB <=v10.6.3 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2022-27458",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-27458"
}
},
"description": "MariaDB\u662fMariaDB\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u514d\u8d39\u5f00\u6e90\u7684\u6570\u636e\u5e93\u7ba1\u7406\u7cfb\u7edf\uff0c\u4e5f\u662f\u4e00\u4e2a\u91c7\u7528Maria\u5b58\u50a8\u5f15\u64ce\u7684MySQL\u5206\u652f\u7248\u672c\u3002\n\nMariaDB v10.6.3\u53ca\u66f4\u4f4e\u7248\u672c\u5b58\u5728\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e/sql/sql_string.h\u7684\u7ec4\u4ef6Binary_string::free_buffer()\u4e2d\u7684\u91ca\u653e\u540e\u91cd\u7528\u9519\u8bef\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u5bfc\u81f4\u7a0b\u5e8f\u5d29\u6e83\u3002",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://jira.mariadb.org/browse/MDEV-28099",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2022-65002",
"openTime": "2022-09-23",
"patchDescription": "MariaDB\u662fMariaDB\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u514d\u8d39\u5f00\u6e90\u7684\u6570\u636e\u5e93\u7ba1\u7406\u7cfb\u7edf\uff0c\u4e5f\u662f\u4e00\u4e2a\u91c7\u7528Maria\u5b58\u50a8\u5f15\u64ce\u7684MySQL\u5206\u652f\u7248\u672c\u3002\r\n\r\nMariaDB v10.6.3\u53ca\u66f4\u4f4e\u7248\u672c\u5b58\u5728\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e/sql/sql_string.h\u7684\u7ec4\u4ef6Binary_string::free_buffer()\u4e2d\u7684\u91ca\u653e\u540e\u91cd\u7528\u9519\u8bef\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u5bfc\u81f4\u7a0b\u5e8f\u5d29\u6e83\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "MariaDB Binary_string::free_buffer()\u7ec4\u4ef6\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "MariaDB MariaDB \u003c=v10.6.3"
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-27458",
"serverity": "\u4e2d",
"submitTime": "2022-04-18",
"title": "MariaDB Binary_string::free_buffer()\u7ec4\u4ef6\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e"
}
bit-mariadb-2022-27458
Vulnerability from bitnami_vulndb
Published
2024-03-06 10:58
Modified
2024-03-06 11:25
Summary
Details
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.
{
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "mariadb",
"purl": "pkg:bitnami/mariadb"
},
"ranges": [
{
"events": [
{
"introduced": "10.3.0"
},
{
"fixed": "10.3.35"
},
{
"introduced": "10.4.0"
},
{
"fixed": "10.4.25"
},
{
"introduced": "10.5.0"
},
{
"fixed": "10.5.16"
},
{
"introduced": "10.6.0"
},
{
"fixed": "10.6.8"
},
{
"introduced": "10.7.0"
},
{
"fixed": "10.7.4"
}
],
"type": "SEMVER"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
],
"aliases": [
"CVE-2022-27458"
],
"database_specific": {
"cpes": [
"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*"
],
"severity": "High"
},
"details": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.",
"id": "BIT-mariadb-2022-27458",
"modified": "2024-03-06T11:25:28.861Z",
"published": "2024-03-06T10:58:21.495Z",
"references": [
{
"type": "WEB",
"url": "https://jira.mariadb.org/browse/MDEV-28099"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220526-0007/"
}
],
"schema_version": "1.5.0"
}
GSD-2022-27458
Vulnerability from gsd - Updated: 2023-12-13 01:19Details
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-27458",
"description": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.",
"id": "GSD-2022-27458",
"references": [
"https://www.suse.com/security/cve/CVE-2022-27458.html",
"https://access.redhat.com/errata/RHSA-2022:5759",
"https://access.redhat.com/errata/RHSA-2022:5826",
"https://access.redhat.com/errata/RHSA-2022:5948",
"https://access.redhat.com/errata/RHSA-2022:6306",
"https://access.redhat.com/errata/RHSA-2022:6443",
"https://ubuntu.com/security/CVE-2022-27458"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-27458"
],
"details": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.",
"id": "GSD-2022-27458",
"modified": "2023-12-13T01:19:40.961852Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-27458",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jira.mariadb.org/browse/MDEV-28099",
"refsource": "MISC",
"url": "https://jira.mariadb.org/browse/MDEV-28099"
},
{
"name": "https://security.netapp.com/advisory/ntap-20220526-0007/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20220526-0007/"
},
{
"name": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.3.35",
"versionStartIncluding": "10.3.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.7.4",
"versionStartIncluding": "10.7.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.4.25",
"versionStartIncluding": "10.4.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.5.16",
"versionStartIncluding": "10.5.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.6.8",
"versionStartIncluding": "10.6.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-27458"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jira.mariadb.org/browse/MDEV-28099",
"refsource": "MISC",
"tags": [
"Exploit",
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://jira.mariadb.org/browse/MDEV-28099"
},
{
"name": "https://security.netapp.com/advisory/ntap-20220526-0007/",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20220526-0007/"
},
{
"name": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2022-10-08T03:11Z",
"publishedDate": "2022-04-14T13:15Z"
}
}
}
CVE-2022-27458
Vulnerability from fstec - Published: 16.03.2022
VLAI Severity ?
Title
Уязвимость функции Binary_string::free_buffer() компонента /sql/sql_string.h СУБД MariaDB, позволяющая нарушителю вызвать отказ в обслуживании
Description
Уязвимость функции Binary_string::free_buffer() компонента /sql/sql_string.h СУБД MariaDB связана с использованием памяти после её освобождения. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, вызвать отказ в обслуживании
Severity ?
Vendor
Сообщество свободного программного обеспечения, ООО «РусБИТех-Астра», АО «ИВК», MariaDB Foundation, АО "НППКТ", АО «НТЦ ИТ РОСА»
Software Name
Debian GNU/Linux, Astra Linux Special Edition (запись в едином реестре российских программ №369), Альт 8 СП (запись в едином реестре российских программ №4305), MariaDB, ОСОН ОСнова Оnyx (запись в едином реестре российских программ №5913), РОСА ХРОМ (запись в едином реестре российских программ №1607)
Software Version
10 (Debian GNU/Linux), 11 (Debian GNU/Linux), 1.7 (Astra Linux Special Edition), - (Альт 8 СП), от 10.3.0 до 10.3.35 (MariaDB), от 10.4.0 до 10.4.25 (MariaDB), от 10.5.0 до 10.5.16 (MariaDB), от 10.6.0 до 10.6.8 (MariaDB), от 10.7.0 до 10.7.4 (MariaDB), 4.7 (Astra Linux Special Edition), до 2.5.1 (ОСОН ОСнова Оnyx), 12.4 (РОСА ХРОМ)
Possible Mitigations
Для MariaDB:
использование рекомендаций производителя: https://mariadb.com/kb/en/security/
Для Debian:
использование рекомендаций производителя: https://security-tracker.debian.org/tracker/CVE-2022-27458
Для ОС Astra Linux:
использование рекомендаций производителя:
https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47
https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17
Для ОСОН ОСнова Оnyx:
Обновление программного обеспечения mariadb-10.3 до версии 1:10.3.35+repack-0+deb10u0.osnova1
Для ОС Альт 8 СП:
установка обновления из публичного репозитория программного средства
Для операционной системы РОСА ХРОМ: https://abf.rosalinux.ru/advisories/ROSA-SA-2023-2254
Reference
https://jira.mariadb.org/browse/MDEV-28099
https://mariadb.com/kb/en/security/
https://nvd.nist.gov/vuln/detail/CVE-2022-27458
https://security-tracker.debian.org/tracker/CVE-2022-27458
https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17
https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47
https://поддержка.нппкт.рф/bin/view/ОСнова/Обновления/2.5.1/
https://altsp.su/obnovleniya-bezopasnosti/
https://abf.rosalinux.ru/advisories/ROSA-SA-2023-2254
CWE
CWE-416
{
"CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb, MariaDB Foundation, \u0410\u041e \"\u041d\u041f\u041f\u041a\u0422\", \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "10 (Debian GNU/Linux), 11 (Debian GNU/Linux), 1.7 (Astra Linux Special Edition), - (\u0410\u043b\u044c\u0442 8 \u0421\u041f), \u043e\u0442 10.3.0 \u0434\u043e 10.3.35 (MariaDB), \u043e\u0442 10.4.0 \u0434\u043e 10.4.25 (MariaDB), \u043e\u0442 10.5.0 \u0434\u043e 10.5.16 (MariaDB), \u043e\u0442 10.6.0 \u0434\u043e 10.6.8 (MariaDB), \u043e\u0442 10.7.0 \u0434\u043e 10.7.4 (MariaDB), 4.7 (Astra Linux Special Edition), \u0434\u043e 2.5.1 (\u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx), 12.4 (\u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0414\u043b\u044f MariaDB:\n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://mariadb.com/kb/en/security/\n\n\u0414\u043b\u044f Debian:\n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://security-tracker.debian.org/tracker/CVE-2022-27458\n\n\u0414\u043b\u044f \u041e\u0421 Astra Linux:\n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47\nhttps://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17\n\n\u0414\u043b\u044f \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx:\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f mariadb-10.3 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1:10.3.35+repack-0+deb10u0.osnova1\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u043b\u044c\u0442 8 \u0421\u041f: \n\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\n\n\u0414\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c: https://abf.rosalinux.ru/advisories/ROSA-SA-2023-2254",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "16.03.2022",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "09.11.2023",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.11.2022",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2022-06910",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-27458",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Debian GNU/Linux, Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u0410\u043b\u044c\u0442 8 \u0421\u041f (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164305), MariaDB, \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913), \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161607)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.7 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u043b\u044c\u0442 8 \u0421\u041f - (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164305), \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 4.7 ARM (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u0410\u041e \"\u041d\u041f\u041f\u041a\u0422\" \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx \u0434\u043e 2.5.1 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913), \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c 12.4 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161607)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 Binary_string::free_buffer() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 /sql/sql_string.h \u0421\u0423\u0411\u0414 MariaDB, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (CWE-416)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 Binary_string::free_buffer() \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 /sql/sql_string.h \u0421\u0423\u0411\u0414 MariaDB \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://jira.mariadb.org/browse/MDEV-28099\nhttps://mariadb.com/kb/en/security/\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-27458\nhttps://security-tracker.debian.org/tracker/CVE-2022-27458\nhttps://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17\nhttps://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47\nhttps://\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430.\u043d\u043f\u043f\u043a\u0442.\u0440\u0444/bin/view/\u041e\u0421\u043d\u043e\u0432\u0430/\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f/2.5.1/\nhttps://altsp.su/obnovleniya-bezopasnosti/\nhttps://abf.rosalinux.ru/advisories/ROSA-SA-2023-2254",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0421\u0423\u0411\u0414",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-416",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…