PT-2023-6190 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.34 and prior MySQL Server version 8.1.0 Description: The vulnerability in the MySQL Server product of Oracle MySQL is related to insufficient input validation in the Server: Optimizer component. This vulnerability ca...

PT-2023-6193 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.34 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of MySQL Server, allowing a remote attacker to cause a denial of service via the MySQL network...

PT-2023-6204 · Oracle +11 · Mysql Server +10

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.7.43 and prior MySQL Server versions 8.0.34 and prior MySQL Server version 8.1.0 Description: The vulnerability in the MySQL Server product, specifically in the InnoDB component, is related to insufficient input...

PT-2023-6387 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.33 and prior Description: The issue is related to a vulnerability in the MySQL Server product of Oracle MySQL, specifically in the Server: Security: Encryption component. This vulnerability allows a high privileged...

mysql-server:fuzz_mysqld: Heap-use-after-free in Batch_segment::write

Detailed Report: https://oss-fuzz.com/testcase?key=4504694106750976 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzmysqld Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x6120001bb688 Crash State: Batchsegment::write...

Medium: mariadb

Issue Overview: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

Fedora 38 : community-mysql (2023-492105ed08)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-492105ed08 advisory. MySQL 8.0.34 Release notes: https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-34.html Tenable has extracted the preceding description block...

Oracle Linux 7 : mariadb (ELSA-2019-2327)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2327 advisory. - CVEs fixed: 1610986 CVE-2018-3058 CVE-2018-3063 CVE-2018-3066 CVE-2018-3081 - CVEs fixed: 1664043 CVE-2018-3282 CVE-2019-2503 Tenable has extracted t...

Oracle Linux 8 : mariadb:10.3 (ELSA-2019-3708)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3708 advisory. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.6....

Oracle Linux 7 : mariadb (ELSA-2020-1100)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1100 advisory. - Rebase to 5.5.65 Also fixes: CVE-2019-2737 CVE-2019-2739 CVE-2019-2740 CVE-2019-2805 Resolves: 1741357 Tenable has extracted the preceding descriptio...

Oracle Linux 7 : mariadb (ELSA-2020-4026)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4026 advisory. - CVEs fixed: rhbz1821939 CVE-2020-2574 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note th...

mysql-server:fuzz_initfile: Heap-buffer-overflow in String::append

Project: https://github.com/mysql/mysql-server.git Detailed Report: https://oss-fuzz.com/testcase?key=6379269012717568 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzinitfile Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-buffer-overflow READ 3 Crash...

mysql-server:fuzz_initfile: Heap-buffer-overflow in my_ismbchar_utf8mb3

Project: https://github.com/mysql/mysql-server.git Detailed Report: https://oss-fuzz.com/testcase?key=5941955778183168 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzinitfile Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash...

FreeBSD : MySQL -- Multiple vulnerabilities (759a5599-3ce8-11ee-a0d1-84a93843eb75)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 759a5599-3ce8-11ee-a0d1-84a93843eb75 advisory. - A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an...

PT-2023-27187

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 aka krb5 versions 1.21 through 1.21.1 MySQL Server versions 8.0.34 and earlier, 8.1.0 and earlier Description The issue is related to a double free in the kdc/do tgs req.c file of MIT Kerberos 5, which can be triggered by an...

MySQL Client Unauthorized Access

The vulnerability of the Server: Optimizer component of the MySQL database management system is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).

...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.42 and prior and 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server and unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H).

...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

...