Summary
It was discovered that MariaDB didn't properly validate the content of a packet
received from a server. A remote attacker could use this vulnerability to sent
a specialy crafted file to cause a denial of service. (CVE-2020-13249)
It was discovered that MariaDB has other security issues. An attacker can cause
a hang or frequently repeatable crash (denial of service). (CVE-2020-15180,
CVE-2020-2752, CVE-2020-2760, CVE-2020-2812, CVE-2020-2814)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | mariadb-10.1 | 1:10.1.47-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | mariadb-10.3 | 1:10.3.25-0ubuntu0.20.04.1 |
Vulnerabilities 6
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 5.3
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Unscored —
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet rec…
-
Unscored —
A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for c…