Oracle MySQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 15

• Critical 9.8
  CVE-2025-9230

  Out-of-bounds read & write in RFC 3211 KEK Unwrap

  Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 30, 2025
• High 7.5
  CVE-2025-9086

  Out of bounds read for cookie path

  1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…

  curl curl curl curl Debian Ubuntu Alpine
  Sep 12, 2025
• High 7.2
  CVE-2025-6965 Public exploit EPSS 73%

  Integer Truncation on SQLite

  There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

  SQLite SQLite qt6-qtwebengine sqlite3 Debian Ubuntu Azure Linux Alpine Wolfi NuGet
  Jul 15, 2025
• High 7.1
  CVE-2025-65018 Public exploit

  LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

  LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…

  pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 24, 2025
• Medium 6.5
  CVE-2026-21949

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jan 20, 2026
• Medium 6.5
  CVE-2026-21950

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jan 20, 2026
• Medium 6.5
  CVE-2026-21968

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu Azure Linux
  Jan 20, 2026
• Medium 5.3
  CVE-2026-21929

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jan 20, 2026
• Medium 4.9
  CVE-2026-21936

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server MySQL Cluster percona-server-5.6 Ubuntu Azure Linux
  Jan 20, 2026
• Medium 4.9
  CVE-2026-21937

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 20, 2026
• Medium 4.9
  CVE-2026-21941

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 20, 2026
• Medium 4.9
  CVE-2026-21948

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 20, 2026
• Medium 4.9
  CVE-2026-21952

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jan 20, 2026
• Medium 4.9
  CVE-2026-21964

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  Jan 20, 2026
• Low 2.7
  CVE-2026-21965

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that …

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jan 20, 2026

Revision history

1. 2026-05-21 #15

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

2. 2026-04-06 #14

   Neue Updates von Red Hat, Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

3. 2026-04-01 #13

   Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

4. 2026-03-26 #12

   Neue Updates von Oracle Linux aufgenommen

5. 2026-03-25 #11

   Neue Updates von Oracle Linux aufgenommen

6. 2026-03-24 #10

   Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

7. 2026-03-23 #9

   Neue Updates von Red Hat aufgenommen

8. 2026-03-18 #8

   Neue Updates von Oracle Linux aufgenommen

9. 2026-03-17 #7

   Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

10. 2026-03-10 #6

    Neue Updates von Oracle Linux aufgenommen

11. 2026-03-09 #5

    Neue Updates von Red Hat aufgenommen

12. 2026-02-03 #4

    Neue Updates von Ubuntu aufgenommen

13. 2026-02-02 #3

    Neue Updates von Ubuntu aufgenommen

14. 2026-01-21 #2

    Referenz(en) aufgenommen: EUVD-2026-3544

15. 2026-01-20 #1

    Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2026 - Appendix Oracle MySQL vom 2026-01-20
  https://www.oracle.com/security-alerts/cpujan2026.html#AppendixMSQL
• Ubuntu Security Notice USN-7994-1 vom 2026-02-03
  https://ubuntu.com/security/notices/USN-7994-1
• Ubuntu Security Notice USN-8006-1 vom 2026-02-04
  https://ubuntu.com/security/notices/USN-8006-1
• Red Hat Security Advisory RHSA-2026:4162 vom 2026-03-10
  https://access.redhat.com/errata/RHSA-2026:4162
• Oracle Linux Security Advisory ELSA-2026-4162 vom 2026-03-10
  https://linux.oracle.com/errata/ELSA-2026-4162.html
• Rocky Linux Security Advisory RLSA-2026:4828 vom 2026-03-18
  https://errata.build.resf.org/RLSA-2026:4828
• Red Hat Security Advisory RHSA-2026:4828 vom 2026-03-18
  https://access.redhat.com/errata/RHSA-2026:4828
• Oracle Linux Security Advisory ELSA-2026-4828 vom 2026-03-18
  https://linux.oracle.com/errata/ELSA-2026-4828.html
• Red Hat Security Advisory RHSA-2026:5580 vom 2026-03-24
  https://access.redhat.com/errata/RHSA-2026:5580
• Rocky Linux Security Advisory RLSA-2026:5580 vom 2026-03-24
  https://errata.build.resf.org/RLSA-2026:5580
• Red Hat Security Advisory RHSA-2026:5640 vom 2026-03-24
  https://access.redhat.com/errata/RHSA-2026:5640
• Rocky Linux Security Advisory RLSA-2026:5640 vom 2026-03-24
  https://errata.build.resf.org/RLSA-2026:5640
• Oracle Linux Security Advisory ELSA-2026-5640 vom 2026-03-26
  http://linux.oracle.com/errata/ELSA-2026-5640.html
• Oracle Linux Security Advisory ELSA-2026-5580 vom 2026-03-27
  http://linux.oracle.com/errata/ELSA-2026-5580.html
• Oracle Linux Security Advisory ELSA-2026-5580 vom 2026-03-26
  https://linux.oracle.com/errata/ELSA-2026-5580.html
• Rocky Linux Security Advisory RLSA-2026:6391 vom 2026-04-02
  https://errata.build.resf.org/RLSA-2026:6391
• Red Hat Security Advisory RHSA-2026:6391 vom 2026-04-01
  https://access.redhat.com/errata/RHSA-2026:6391
• Red Hat Security Advisory RHSA-2026:6435 vom 2026-04-02
  https://access.redhat.com/errata/RHSA-2026:6435
• Rocky Linux Security Advisory RLSA-2026:6435 vom 2026-04-02
  https://errata.build.resf.org/RLSA-2026:6435
• Oracle Linux Security Advisory ELSA-2026-6435 vom 2026-04-03
  https://linux.oracle.com/errata/ELSA-2026-6435.html
• Oracle Linux Security Advisory ELSA-2026-6391 vom 2026-04-03
  https://linux.oracle.com/errata/ELSA-2026-6391.html
• Rocky Linux Security Advisory RLSA-2026:4162 vom 2026-05-21
  https://errata.build.resf.org/RLSA-2026:4162