Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Product
MySQL ist ein Open Source Datenbankserver von Oracle.
Vulnerabilities 16
-
Critical 9.4CVE-2025-4517 Public exploit
Arbitrary writes via tarfile realpath overflow
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() usin…
-
Critical 9.1
Libxml: type confusion leads to denial of service (dos)
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of …
-
High 7.5
WebSocket endless loop
Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the threa…
-
High 7.2
Integer Truncation on SQLite
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
-
Medium 5.6
Requests `Session` object does not verify requests after making first request with verify=False
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification r…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 5.4
Libssh: out-of-bounds read in sftp_handle()
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return …
-
Medium 5.3
Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to s…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions …
Revision history
-
#9
Neue Updates von Ubuntu aufgenommen
-
#8
Neue Updates von Oracle Linux aufgenommen
-
#7
Neue Updates von Red Hat aufgenommen
-
#6
Neue Updates von Oracle Linux und Red Hat aufgenommen
-
#5
Neue Updates von Red Hat aufgenommen
-
#4
Neue Updates von Ubuntu aufgenommen
-
#3
Neue Updates von XEROX aufgenommen
-
#2
Referenz(en) aufgenommen: EUVD-2025-35267, EUVD-2025-35280, EUVD-2025-35294, EUVD-2025-35265, EUVD-2025-35272, EUVD-2025-35290, EUVD-2025-35289, EUVD-2025-35292, EUVD-2025-35281
-
#1
Initiale Fassung
References
-
Oracle Critical Patch Update Advisory - October 2025 - Appendix Oracle MySQL vom 2025-10-21
https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixMSQL
-
XEROX Security Advisory XRX25-018 vom 2025-11-18
https://security.business.xerox.com/wp-content/uploads/2025/11/Xerox-Security-Bulletin-XRX25-018-Xerox-FreeFlow-Print-Server-v7.pdf
-
Ubuntu Security Notice USN-7873-1 vom 2025-11-20
https://ubuntu.com/security/notices/USN-7873-1
-
Red Hat Security Advisory RHSA-2025:23008 vom 2025-12-10
https://access.redhat.com/errata/RHSA-2025:23008
-
Oracle Linux Security Advisory ELSA-2025-23008 vom 2025-12-11
http://linux.oracle.com/errata/ELSA-2025-23008.html
-
Red Hat Security Advisory RHSA-2025:23109 vom 2025-12-11
https://access.redhat.com/errata/RHSA-2025:23109
-
Red Hat Security Advisory RHSA-2025:23137 vom 2025-12-11
https://access.redhat.com/errata/RHSA-2025:23137
-
Red Hat Security Advisory RHSA-2025:23111 vom 2025-12-11
https://access.redhat.com/errata/RHSA-2025:23111
-
Red Hat Security Advisory RHSA-2025:23134 vom 2025-12-11
https://access.redhat.com/errata/RHSA-2025:23134
-
Rocky Linux Security Advisory RLSA-2025:23008 vom 2025-12-12
https://errata.build.resf.org/RLSA-2025:23008
-
Rocky Linux Security Advisory RLSA-2025:23137 vom 2025-12-12
https://errata.build.resf.org/RLSA-2025:23137
-
Rocky Linux Security Advisory RLSA-2025:23111 vom 2025-12-12
https://errata.build.resf.org/RLSA-2025:23111
-
Rocky Linux Security Advisory RLSA-2025:23134 vom 2025-12-12
https://errata.build.resf.org/RLSA-2025:23134
-
Rocky Linux Security Advisory RLSA-2025:23109 vom 2025-12-12
https://errata.build.resf.org/RLSA-2025:23109
-
Oracle Linux Security Advisory ELSA-2025-23137 vom 2025-12-12
https://linux.oracle.com/errata/ELSA-2025-23137.html
-
Oracle Linux Security Advisory ELSA-2025-23109 vom 2025-12-13
https://linux.oracle.com/errata/ELSA-2025-23109.html
-
Oracle Linux Security Advisory ELSA-2025-23111 vom 2025-12-12
https://linux.oracle.com/errata/ELSA-2025-23111.html
-
Oracle Linux Security Advisory ELSA-2025-23134 vom 2025-12-13
https://linux.oracle.com/errata/ELSA-2025-23134.html
-
Ubuntu Security Notice USN-8006-1 vom 2026-02-04
https://ubuntu.com/security/notices/USN-8006-1