Oracle MySQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 60

• Critical 9.8
  CVE-2019-5481

  Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

  curl curl curl gnurl Debian Ubuntu Alpine
  Sep 16, 2019
• Critical 9.8
  CVE-2019-5482 EPSS 18%

  Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

  curl curl curl gnurl Debian Ubuntu Alpine
  Sep 16, 2019
• High 7.5
  CVE-2019-17563 EPSS 11%

  In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack

  When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical …

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Dec 23, 2019
• High 7.1
  CVE-2019-14889

  A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh …

  Red Hat libssh libssh libssh Debian Ubuntu Alpine
  Dec 10, 2019
• Medium 6.5
  CVE-2020-2780

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 6.5
  CVE-2020-2790

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 6.3
  CVE-2020-2768

  Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…

  Oracle MySQL Cluster
  Apr 15, 2020
• Medium 5.9
  CVE-2020-2804

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 5.5
  CVE-2020-2760

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine
  Apr 15, 2020
• Medium 5.3
  CVE-2020-2752

  Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine
  Apr 15, 2020
• Medium 5.3
  CVE-2020-2806

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 5.0
  CVE-2020-2934

  Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are aff…

  Oracle WebLogic Server mysql-connector-java Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2759

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2761

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2762

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2763

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2765

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2770

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are aff…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2774

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2779

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2812

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2814

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Alpine
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2853

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2892

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2893

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2895

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2896

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2897

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2898

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Charsets). The supported version that is …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2901

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2903

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2904

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2923

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2924

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2925

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.9
  CVE-2020-2928

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.7
  CVE-2020-2875

  Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are aff…

  Oracle MySQL Connectors mysql-connector-java Ubuntu
  Apr 15, 2020
• Medium 4.4
  CVE-2020-2921

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported vers…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.4
  CVE-2020-2926

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported version…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Medium 4.4
  CVE-2020-2930

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Low 3.7
  CVE-2020-2922

  Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Apr 15, 2020
• Low 2.2
  CVE-2020-2933

  Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are aff…

  Oracle MySQL Connectors mysql-connector-java Ubuntu
  Apr 15, 2020
• Unscored —
  CVE-2019-1547

  ECDSA remote timing attack

  Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is p…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  Sep 10, 2019
• Unscored —
  CVE-2019-1549

  Fork Protection

  OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection w…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  Sep 10, 2019
• Unscored —
  CVE-2019-1552

  Windows builds with insecure path defaults

  OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir con…

  OpenSSL OpenSSL
  Jul 30, 2019
• Unscored —
  CVE-2019-15601 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…

  Jan 6, 2020
• Unscored —
  CVE-2019-1563

  Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

  In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine
  Sep 10, 2019
• Unscored —
  CVE-2019-19242

  SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.

  sqlite3 sqlite Debian Alpine
  Nov 25, 2019
• Unscored —
  CVE-2019-19244

  sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and …

  sqlite3 sqlite Debian Alpine
  Nov 25, 2019
• Unscored —
  CVE-2019-19317

  lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which a…

  Dec 5, 2019
• Unscored —
  CVE-2019-19603 EPSS 11%

  SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

  sqlite3 sqlite3 Debian Ubuntu
  Dec 9, 2019
• Unscored —
  CVE-2019-19645

  alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential v…

  sqlite3 sqlite3 ceph Debian Ubuntu Azure Linux
  Dec 9, 2019
• Unscored —
  CVE-2019-19646

  pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generate…

  ceph Azure Linux
  Dec 9, 2019
• Unscored —
  CVE-2019-19880

  exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because cons…

  chromium sqlite3 Debian
  Dec 18, 2019
• Unscored —
  CVE-2019-19923

  flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which …

  chromium sqlite3 sqlite3 Debian Ubuntu
  Dec 24, 2019
• Unscored —
  CVE-2019-19924 EPSS 11%

  SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by i…

  sqlite3 Debian
  Dec 24, 2019
• Unscored —
  CVE-2019-19925

  zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

  chromium sqlite3 sqlite3 Debian Ubuntu
  Dec 24, 2019
• Unscored —
  CVE-2019-19926

  multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlit…

  chromium sqlite3 Debian Ubuntu
  Dec 23, 2019
• Unscored —
  CVE-2019-19959

  ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' charac…

  sqlite3 sqlite3 Debian Ubuntu
  Jan 3, 2020
• Unscored —
  CVE-2019-20218

  selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.

  sqlite3 sqlite3 Debian Ubuntu
  Jan 2, 2020

Revision history

1. 2023-04-20 #29

   Neue Updates von Amazon aufgenommen

2. 2022-02-03 #28

   Neue Updates von Red Hat aufgenommen

3. 2022-01-27 #27

   Neue Updates von Red Hat aufgenommen

4. 2021-11-09 #26

   Neue Updates von Red Hat aufgenommen

5. 2021-08-30 #25

   Neue Updates von SUSE aufgenommen

6. 2021-07-29 #24

   Neue Updates von SUSE aufgenommen

7. 2021-07-14 #23

   Neue Updates von SUSE aufgenommen

8. 2021-05-25 #22

   Neue Updates von Gentoo aufgenommen

9. 2021-02-24 #21

   Neue Updates von Red Hat aufgenommen

10. 2021-01-18 #20

    Neue Updates von Red Hat aufgenommen

11. 2020-12-17 #19

    Neue Updates von Oracle Linux aufgenommen

12. 2020-12-09 #18

    Neue Updates von AVAYA aufgenommen

13. 2020-11-30 #17

    Neue Updates von Red Hat aufgenommen

14. 2020-11-05 #16

    Neue Updates von Red Hat aufgenommen

15. 2020-11-03 #15

    Neue Updates von Red Hat aufgenommen

16. 2020-10-27 #14

    Neue Updates von Ubuntu aufgenommen

17. 2020-10-25 #13

    Neue Updates von AVAYA aufgenommen

18. 2020-10-05 #12

    Neue Updates von Red Hat aufgenommen

19. 2020-09-29 #11

    Neue Updates von Red Hat aufgenommen

20. 2020-09-15 #10

    Neue Updates von Red Hat aufgenommen

21. 2020-09-14 #9

    Neue Updates von Red Hat aufgenommen

22. 2020-08-19 #8

    Neue Updates von Red Hat aufgenommen

23. 2020-07-28 #7

    Neue Updates von Red Hat aufgenommen

24. 2020-06-23 #6

    Neue Updates von SUSE aufgenommen

25. 2020-06-11 #5

    Neue Updates von Debian aufgenommen

References

• Amazon Linux Security Advisory ALAS2-2023-2017 vom 2023-04-21
  https://alas.aws.amazon.com/AL2/ALAS-2023-2017.html
• Oracle Critical Patch Update Advisory - April 2020 vom 2020-04-14
  https://www.oracle.com/security-alerts/cpuapr2020.html#AppendixMSQL
• Red Hat Security Advisory RHSA-2020:1810 vom 2020-04-28
  https://access.redhat.com/errata/RHSA-2020:1810
• Ubuntu Security Notice USN-4350-1 vom 2020-05-04
  https://usn.ubuntu.com/4350-1/
• Debian Security Advisory DLA 2245 vom 2020-06-12
  https://lists.debian.org/debian-lts-announce/2020/debian-lts-announce-202006/msg00015.html
• Debian Security Advisory DSA-4703 vom 2020-06-11
  https://www.debian.org/security/2020/dsa-4703
• SUSE Security Update SUSE-SU-2020:1710-1 vom 2020-06-23
  http://lists.suse.com/pipermail/sle-security-updates/2020-June/007007.html
• SUSE Security Update SUSE-SU-2020:1711-1 vom 2020-06-23
  http://lists.suse.com/pipermail/sle-security-updates/2020-June/007010.html
• Red Hat Security Advisory RHSA-2020:3194 vom 2020-07-28
  https://access.redhat.com/errata/RHSA-2020:3194
• Red Hat Security Advisory RHSA-2020:3518 vom 2020-08-19
  https://access.redhat.com/errata/RHSA-2020:3518
• Red Hat Security Advisory RHSA-2020:3732 vom 2020-09-14
  https://access.redhat.com/errata/RHSA-2020:3732
• Red Hat Security Advisory RHSA-2020:3755 vom 2020-09-15
  https://access.redhat.com/errata/RHSA-2020:3755
• Red Hat Security Advisory RHSA-2020:3757 vom 2020-09-15
  https://access.redhat.com/errata/RHSA-2020:3757
• Red Hat Security Advisory RHSA-2020:4026 vom 2020-09-29
  https://access.redhat.com/errata/RHSA-2020:4026
• Red Hat Security Advisory RHSA-2020:4174 vom 2020-10-05
  https://access.redhat.com/errata/RHSA-2020:4174
• AVAYA Security Advisory ASA-2020-112 vom 2020-10-25
  https://downloads.avaya.com/css/P8/documents/101071742
• Ubuntu Security Notice USN-4603-1 vom 2020-10-27
  https://ubuntu.com/security/notices/USN-4603-1
• Ubuntu Security Notice USN-4603-1 vom 2020-10-27
  https://usn.ubuntu.com/4603-1/
• Red Hat Security Advisory RHSA-2020:4442 vom 2020-11-04
  https://access.redhat.com/errata/RHSA-2020:4442
• Red Hat Security Advisory RHSA-2020:4961 vom 2020-11-05
  https://access.redhat.com/errata/RHSA-2020:4961
• Red Hat Security Advisory RHSA-2020:4960 vom 2020-11-05
  https://access.redhat.com/errata/RHSA-2020:4960
• Red Hat Security Advisory RHSA-2020:5246 vom 2020-11-30
  https://access.redhat.com/errata/RHSA-2020:5246
• AVAYA Security Advisory ASA-2020-162 vom 2020-12-08
  https://downloads.avaya.com/css/P8/documents/101072831
• Oracle Linux Security Advisory ELSA-2020-5503 vom 2020-12-18
  https://linux.oracle.com/errata/ELSA-2020-5503-1.html
• Oracle Linux Security Advisory ELSA-2020-5500 vom 2020-12-18
  https://linux.oracle.com/errata/ELSA-2020-5500.html
• Gentoo Linux Security Advisory GLSA-202105-27 vom 2021-05-26
  https://security.gentoo.org/glsa/202105-27
• Red Hat Security Advisory RHSA-2021:0037 vom 2021-01-18
  https://access.redhat.com/errata/RHSA-2021:0038
• Red Hat Security Advisory RHSA-2020:5635 vom 2021-02-24
  https://access.redhat.com/errata/RHSA-2020:5635
• SUSE Security Update SUSE-SU-2021:2320-1 vom 2021-07-14
  https://lists.suse.com/pipermail/sle-security-updates/2021-July/009137.html
• SUSE Security Update SUSE-SU-2021:14771-1 vom 2021-07-29
  https://lists.suse.com/pipermail/sle-security-updates/2021-July/009231.html
• SUSE Security Update SUSE-SU-2021:2877-1 vom 2021-08-30
  https://lists.suse.com/pipermail/sle-security-updates/2021-August/009371.html
• Red Hat Security Advisory RHSA-2021:4396 vom 2021-11-09
  https://access.redhat.com/errata/RHSA-2021:4396
• Red Hat Security Advisory RHSA-2022:0318 vom 2022-01-27
  https://access.redhat.com/errata/RHSA-2022:0318
• Red Hat Security Advisory RHSA-2022:0434 vom 2022-02-04
  https://access.redhat.com/errata/RHSA-2022:0434