- packagers - lists.mariadb.org

MariaDB 5.5.46 release
by Daniel Bartholomew 12 Oct '15

12 Oct '15

MariaDB 5.5.46 has been released. It's a maintenance release. - git revision hash: 16c4b3c68b06653592a9500050ad977a38f4ebae - https://downloads.mariadb.org/mariadb/5.5.46/ - https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/ - https://mariadb.com/kb/en/mariadb/mariadb-5546-changelog/ FYI: I'm going to start giving a heads up here whenever there is a new release of MariaDB about to come out. For this release it's happening right after the release, but in the future I'll try to send the notice out when I start working on a release, which is usually around 24 hours before a release is announced, again, just to give everyone here a heads up that a release is imminent. Thanks. -- Daniel Bartholomew, MariaDB Release Manager MariaDB | http://mariadb.com

1 0

Serious issue in latest MariaDB 5.5 anf 10.0 releases
by Sergei Golubchik 12 May '15

12 May '15

Hi, packagers, MariaDB 5.5.43 and 10.0.18 unfortunately introduced a quite serious bug affecting the mysql_upgrade utility. The new REPAIR VIEW command that mysql_upgrade runs crashes the server on views that contain blob fields. So if you run mysql_upgrade on upgrade automatically and user has such blobs - there will be a crash. This is https://mariadb.atlassian.net/browse/MDEV-8115. We're releasing a fixed 10.0.19 now. But 5.5.44 release has to wait for MySQL-5.5.44 release (about a month, I'd say). If you'd like to package 5.5.43 or 10.0.18, here's a simple patch for this bug: https://github.com/MariaDB/server/commit/0014bdc7 Sorry for this. Regards, Sergei Golubchik MariaDB Security Coordinator

3 2

Re: [MariaDB Packagers] [Maria-discuss] Merging FusionIO changes to 10.0.12
by Heinz Wiesinger 16 May '14

16 May '14

On Friday 16 May 2014 17:28:27 Colin Charles wrote: > Hi all, > > MariaDB has worked actively with Fusion-io, and we did release some > improvements in a preview release a little over a month ago: > https://blog.mariadb.org/significant-performance-boost-with-new-mariadb-pag > e-compression-on-fusionio/ > > This was originally planned to be included into 10.0.10, but when we > released the GA, we thought that the feature was not tested thoroughly. > > Now the code has proven stable we are thinking of merging this into 10.0.12. > Yes, we know its already a GA, but this feature will be turned off by > default, and the code is safely encapsulated. If you are not using > Fusion-io or do not turn it on, there is no effect to you. To check, the > changes are in the XtraDB and InnoDB that we ship (storage/xtradb & > storage/innobase). > > Naturally, for those using Fusion-io devices, the benefits are clear - you > will see significant improvements in speed and you will increase the > lifetime of your cards. Think of this like adding drivers to the Linux > kernel from time to time ;) > > What does everyone think? Package maintainers? IMHO it seems like a reasonable feature to merge, even if it means slightly bending the usual GA restrictions. No objections from Slackware here. Grs, Heinz

1 0

Buffer overflow in MariaDB 5.1 to 5.5
by Sergei Golubchik 26 Nov '12

26 Nov '12

Hi, packagers of MariaDB, We have discovered (*) a classical buffer overflow in MariaDB, that allows an authenticated user to crash the server or execute arbitrary code with the privilegs of the mysqld process. All MariaDB and MySQL version starting from 5.1 are affected. We will be releasing new MariaDB versions containing these patches shortly. The fixed versions are 5.1.66, 5.2.13, 5.3.11 and the next release after 5.5.28 (which will be either 5.5.29 or 5.5.28a, depending on when MySQL-5.5.29 will appear). Regards, Sergei (*) Thanks to Tomas Hoger from the Red Hat Security Response Team ============ The patch: http://bazaar.launchpad.net/~maria-captains/maria/5.3/revision/2643.153.26 Bug entry in our bug tracker (incomplete): https://mariadb.atlassian.net/browse/MDEV-3884 MySQL bug report entry (not public): http://bugs.mysql.com/bug.php?id=67685

1 0

latest Oracle's CPU related to MySQL
by Sergei Golubchik 07 Nov '12

07 Nov '12

Hi, I was asked about security vulnerabilities from the latest Oracle's CPU: http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html#A… So, here is, as a summary, what I think these "unspecified vulnerabilies used via unknown attack vectors" really are. Sometimes it wasn't obvious what changeset fixes a particular CVE bug. And in some cases I would've described the bug differenly, not how CVE entry does it. So, again, this is *my opinion* about how they map to the code changes, and I might be wrong here. Regards, Sergei ==================================== CVE-2012-3144 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/jon.hauglid@or… Revno: 3894 Author: Jon Olav Hauglid <jon.hauglid(a)oracle.com> Date: Tue 2012-07-10 16:13:02 +0200 Bug#12623923 Server can crash after failure to create primary key with innodb tables CVE-2012-3147 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.26 and earlier allows remote attackers to affect integrity and availability, related to MySQL Client. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/georgi.kodinov… Revno: 3885.1.2 Author: Georgi Kodinov <Georgi.Kodinov(a)Oracle.com> Date: Fri 2012-06-29 14:04:24 +0300 Bug #12910665: AUTH-PLUGIN-DATA-LEN NOT TESTED FOR VALIDITY BY THE CLIENT CVE-2012-3149 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.26 and earlier allows remote authenticated users to affect confidentiality, related to MySQL Client. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/georgi.kodinov… Revno: 3884 Author: Georgi Kodinov <Georgi.Kodinov(a)Oracle.com> Date: Thu 2012-07-05 09:55:20 +0300 Bug #12998841: libmysql divulges plaintext password upon request in 5.5 CVE-2012-3150 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/norvald.ryeng@… Revno: 3757.1.1 Author: Norvald H. Ryeng <norvald.ryeng(a)oracle.com> Date: Mon 2012-06-18 09:20:12 +0200 Bug#13003736 CRASH IN ITEM_REF::WALK WITH SUBQUERIES CVE-2012-3156 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/tor.didriksen@… Revno: 3840 Author: Tor Didriksen <tor.didriksen(a)oracle.com> Date: Mon 2012-05-21 10:47:12 +0200 Bug#13986705 CRASH IN GET_INTERVAL_VALUE() WITH DATE CALCULATION WITH UTF32 INTERVALS CVE-2012-3158 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Protocol. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/georgi.kodinov… Revno: 3762 Author: Georgi Kodinov <Georgi.Kodinov(a)Oracle.com> Date: Thu 2012-06-28 18:38:55 +0300 Bug #13708485: malformed resultset packet crashes client CVE-2012-3160 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows local users to affect confidentiality via unknown vectors related to Server Installation. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/nirbhay.choube… Revno: 3780 Author: Nirbhay Choubey <nirbhay.choubey(a)oracle.com> Date: Thu 2012-07-26 21:47:03 +0530 Bug#13741677 MYSQL_SECURE_INSTALLATION DOES NOT WORK + SAVES ROOT PASSWORD TO DISK! The secure installation scripts connect to the server by storing the password in a temporary option file. Now, if the script gets killed or fails for some reason, the removal of the option file may not take place. CVE-2012-3163 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/georgi.kodinov… Revno: 3764.1.1 Author: Georgi Kodinov <Georgi.Kodinov(a)Oracle.com> Date: Thu 2012-07-05 13:41:16 +0300 Bug #13889741: HANDLE_FATAL_SIGNAL IN _DB_ENTER_ | HANDLE_FATAL_SIGNAL IN STRNLEN Fixed the following bounds checking problems : 1. in check_if_legal_filename() make sure the null terminated string is long enough before accessing the bytes in it. Prevents pottential read-past-buffer-end 2. in my_wc_mb_filename() of the filename charset check for the end of the destination buffer before sending single byte characters into it. Prevents write-past-end-of-buffer (and garbaling stack in the cases reported here) errors. CVE-2012-3166 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to InnoDB. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/yasufumi.kinos… Revno: 3730 Author: Yasufumi Kinoshita <yasufumi.kinoshita(a)oracle.com> Date: Fri 2012-04-27 19:38:13 +0900 Bug#11758510 (#50723): INNODB CHECK TABLE FATAL SEMAPHORE WAIT TIMEOUT POSSIBLY TOO SHORT FOR BI CVE-2012-3167 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Full Text Search. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/venkata.sidaga… Revno: 3739 Author: Venkata Sidagam <venkata.sidagam(a)oracle.com> Date: Wed 2012-05-16 16:14:27 +0530 Bug #13955256: KEYCACHE CRASHES, CORRUPTIONS/HANGS WITH, FULLTEXT INDEX AND CONCURRENT DML. Problem Statement: ------------------ 1) Create a table with FT index. 2) Enable concurrent inserts. 3) In multiple threads do below operations repeatedly a) truncate table b) insert into table .... c) select ... match .. against .. non-boolean/boolean mode CVE-2012-3173 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to InnoDB Plugin. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/annamalai.guru… Revno: 3740 Author: Annamalai Gurusami <annamalai.gurusami(a)oracle.com> Date: Wed 2012-05-16 16:36:49 +0530 Bug #13943231: ALTER TABLE AFTER DISCARD MAY CRASH THE SERVER The following scenario crashes our mysql server: 1. set global innodb_file_per_table=1; 2. create table t1(c1 int) engine=innodb; 3. alter table t1 discard tablespace; 4. alter table t1 add unique index(c1); CVE-2012-3177 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/chaithra.gopal… Revno: 3786 Author: Chaithra Gopalareddy <chaithra.gopalareddy(a)oracle.com> Date: Sun 2012-08-05 16:29:28 +0530 Bug #14099846: EXPORT_SET CRASHES DUE TO OVERALLOCATION OF MEMORY Backport the fix from 5.6 to 5.1 Base bug number : 11765562 or http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/tor.didriksen@… Revno: 3784 Author: Tor Didriksen <tor.didriksen(a)oracle.com> Date: Fri 2012-07-27 09:13:10 +0200 Bug#14111180 HANDLE_FATAL_SIGNAL IN PTR_COMPARE_1 / QUEUE_INSERT CVE-2012-3180 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/sergey.glukhov… Revno: 3792 Author: Sergey Glukhov <sergey.glukhov(a)oracle.com> Date: Thu 2012-08-09 15:34:52 +0400 Bug #14409015 MEMORY LEAK WHEN REFERENCING OUTER FIELD IN HAVING When resolving outer fields, Item_field::fix_outer_fields() creates new Item_refs for each execution of a prepared statement, so these must be allocated in the runtime memroot. The memroot switching before resolving JOIN::having causes these to be allocated in the statement root, leaking memory for each PS execution. CVE-2012-3197 ^^^^^^^^^^^^^ Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Replication. http://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/nuno.carvalho@… Revno: 3725.1.1 Author: Nuno Carvalho <nuno.carvalho(a)oracle.com> Date: Fri 2012-04-20 22:25:59 +0100 BUG#13979418: SHOW BINLOG EVENTS MAY CRASH THE SERVER

1 0

Multiple SQL injections in mysqld
by Kristian Nielsen 27 Aug '12

27 Aug '12

I have discovered multiple SQL injection vulnerabilities in MariaDB. All versions are affected (All versions of MySQL back to at least 5.1 are also affected). The issue is multiple places in the code where SQL statements are generated and written into the binary log. User-supplied identifiers (table names, field names, etc.) are not properly quoted (eg. `speci``al name`), so authorised users with access to modify a table can inject arbitrary SQL into the binlog. Such injected SQL will be executed by the slave and could be executed with root privileges if a DBA does a mysqlbinlog|mysql style point-in-time recovery. This is the reason this is escalated as a security issue. For the normal MySQL replication (master-slave, not mysqlbinlog|mysql), these bugs do not seem to have security implications, although they can still provoke syntax errors that abort the replication or cause data corruption on the slave. Just to be clear: to exploit this requires a valid account on the server with privileges to modify data. So there is no remote exploit. Patches for the vulnerabilities can be found here: MariaDB 5.1: http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3151.1.1 bzr log -p -rrevid:knielsen@knielsen-hq.org-20120824080616-0i6chxe8bjto8b7y lp:maria/5.1 MariaDB 5.2: http://bazaar.launchpad.net/~maria-captains/maria/5.2/revision/3163.1.1 bzr log -p -rrevid:knielsen@knielsen-hq.org-20120824103246-3dnymbhrajm36ky4 lp:maria/5.2 MariaDB 5.3: http://bazaar.launchpad.net/~maria-captains/maria/5.3/revision/3556.1.2 bzr log -p -rrevid:knielsen@knielsen-hq.org-20120824120232-fq2i5463qwpnws6u lp:maria/5.3 MariaDB 5.5: http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/3508 bzr log -p -rrevid:knielsen@knielsen-hq.org-20120824132901-h62tb4n77ffj9shb lp:maria/5.5 We will be releasing new MariaDB versions containing these patches shortly. I suggest to plan public disclosure of this bug on September 17; hopefully this should be sufficient time for everyone to update releases. Until then, some reasonable discression about the issue is requested. Here is the bug that will be used after disclosure: https://mariadb.atlassian.net/browse/MDEV-382 - Kristian.

1 0

Test message
by Daniel Bartholomew 19 Apr '12

19 Apr '12

A test message to confirm that the list is working. -- Daniel Bartholomew MariaDB - http://mariadb.org Monty Program - http://montyprogram.com AskMonty Knowledgebase - http://kb.askmonty.org

1 0