openSUSE Security Update: Security update for mysql-community-server
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:2293-1
Rating:             moderate
References:         #1087102 #1088681 #1101676 #1101678 #1101679 
                    #1101680 #1103342 #1103344 
Cross-References:   CVE-2018-0739 CVE-2018-2767 CVE-2018-3058
                    CVE-2018-3062 CVE-2018-3064 CVE-2018-3066
                    CVE-2018-3070 CVE-2018-3081
Affected Products:
                    openSUSE Leap 42.3
______________________________________________________________________________

   An update that fixes 8 vulnerabilities is now available.

Description:

   This update for mysql-community-server to version 5.6.41 fixes the
   following issues:

   Security vulnerabilities fixed:

   - CVE-2018-3064: Fixed an easily exploitable vulnerability that allowed a
     low privileged attacker with network access via multiple protocols to
     compromise the MySQL Server. Successful attacks of this vulnerability
     can result in unauthorized ability to cause a hang or frequently
     repeatable crash (complete DOS) of MySQL Server as well as unauthorized
     update, insert or delete access to some of MySQL Server accessible data.
     (bsc#1103342)

   - CVE-2018-3070: Fixed an easily exploitable vulnerability that allowed a
     low privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Server. (bsc#1101679)

   - CVE-2018-0739: Fixed a stack exhaustion in case of recursively
     constructed ASN.1 types. (boo#1087102)

   - CVE-2018-3062: Fixed a difficult to exploit vulnerability that allowed
     low privileged attacker with network access via memcached to compromise
     MySQL Server. Successful attacks of this vulnerability can result in
     unauthorized ability to cause a hang or frequently repeatable crash
     (complete DOS) of MySQL Server. (bsc#1103344)

   - CVE-2018-3081: Fixed a difficult to exploit vulnerability that allowed
     high privileged attacker with network access via multiple protocols to
     compromise MySQL Client. Successful attacks of this vulnerability can
     result in unauthorized ability to cause a hang or frequently repeatable
     crash (complete DOS) of MySQL Client as well as unauthorized update,
     insert or delete access to some of MySQL Client accessible data.
     (bsc#1101680)

   - CVE-2018-3058: Fixed an easily exploitable vulnerability that allowed
     low privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized update, insert or delete access to some of MySQL
     Server accessible data. (bsc#1101676)

   - CVE-2018-3066: Fixed a difficult to exploit vulnerability allowed high
     privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized update, insert or delete access to some of MySQL
     Server accessible data as well as unauthorized read access to a subset
     of MySQL Server accessible data. (bsc#1101678)

   - CVE-2018-2767: Fixed a difficult to exploit vulnerability that allowed
     low privileged attacker with network access via multiple protocols to
     compromise MySQL Server. Successful attacks of this vulnerability can
     result in unauthorized read access to a subset of MySQL Server
     accessible data. (boo#1088681)

   You can find more detailed information about this update in the [release
   notes](http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-41.html)


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2018-844=1



Package List:

   - openSUSE Leap 42.3 (i586 x86_64):

      libmysql56client18-5.6.41-39.1
      libmysql56client18-debuginfo-5.6.41-39.1
      libmysql56client_r18-5.6.41-39.1
      mysql-community-server-5.6.41-39.1
      mysql-community-server-bench-5.6.41-39.1
      mysql-community-server-bench-debuginfo-5.6.41-39.1
      mysql-community-server-client-5.6.41-39.1
      mysql-community-server-client-debuginfo-5.6.41-39.1
      mysql-community-server-debuginfo-5.6.41-39.1
      mysql-community-server-debugsource-5.6.41-39.1
      mysql-community-server-test-5.6.41-39.1
      mysql-community-server-test-debuginfo-5.6.41-39.1
      mysql-community-server-tools-5.6.41-39.1
      mysql-community-server-tools-debuginfo-5.6.41-39.1

   - openSUSE Leap 42.3 (x86_64):

      libmysql56client18-32bit-5.6.41-39.1
      libmysql56client18-debuginfo-32bit-5.6.41-39.1
      libmysql56client_r18-32bit-5.6.41-39.1

   - openSUSE Leap 42.3 (noarch):

      mysql-community-server-errormessages-5.6.41-39.1


References:

   https://www.suse.com/security/cve/CVE-2018-0739.html
   https://www.suse.com/security/cve/CVE-2018-2767.html
   https://www.suse.com/security/cve/CVE-2018-3058.html
   https://www.suse.com/security/cve/CVE-2018-3062.html
   https://www.suse.com/security/cve/CVE-2018-3064.html
   https://www.suse.com/security/cve/CVE-2018-3066.html
   https://www.suse.com/security/cve/CVE-2018-3070.html
   https://www.suse.com/security/cve/CVE-2018-3081.html
   https://bugzilla.suse.com/1087102
   https://bugzilla.suse.com/1088681
   https://bugzilla.suse.com/1101676
   https://bugzilla.suse.com/1101678
   https://bugzilla.suse.com/1101679
   https://bugzilla.suse.com/1101680
   https://bugzilla.suse.com/1103342
   https://bugzilla.suse.com/1103344

--