MGASA-2019-0147 - Updated mariadb packages fix security vulnerability

Publication date: 10 Apr 2019
URL: https://advisories.mageia.org/MGASA-2019-0147.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2019-2529,
     CVE-2019-2537

Vulnerability in the MariaDB Server component of MariaDB (subcomponent: Server:
Optimizer). Easily exploitable vulnerability allows low privileged attacker
with network access via multiple protocols to compromise MariaDB Server.
Successful attacks of this vulnerability can result in unauthorized ability to
cause a hang or frequently repeatable crash (complete DOS) of MariaDB Server
(CVE-2019-2529).

Vulnerability in the MariaDB Server component of MariaDB (subcomponent: Server:
DDL). Easily exploitable vulnerability allows high privileged attacker with
network access via multiple protocols to compromise MariaDB Server. Successful
attacks of this vulnerability can result in unauthorized ability to cause a
hang or frequently repeatable crash (complete DOS) of MariaDB Server
(CVE-2019-2537).

References:
- https://bugs.mageia.org/show_bug.cgi?id=24624
- https://mariadb.com/kb/en/mariadb-10138-release-notes/
- https://www.oracle.com/security-alerts/cpujan2019.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2529
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2537

SRPMS:
- 6/core/mariadb-10.1.38-1.mga6