Security update for mariadb

Announcement ID:	SUSE-SU-2018:1781-2
Rating:	important
References:	bsc#1088681 bsc#1090518
Cross-References:	CVE-2018-2755 CVE-2018-2761 CVE-2018-2766 CVE-2018-2767 CVE-2018-2771 CVE-2018-2781 CVE-2018-2782 CVE-2018-2784 CVE-2018-2787 CVE-2018-2813 CVE-2018-2817 CVE-2018-2819
CVSS scores:	CVE-2018-2755 ( SUSE ): 7.7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2018-2755 ( NVD ): 7.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2018-2755 ( NVD ): 7.7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2018-2761 ( SUSE ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-2761 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-2761 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-2766 ( NVD ): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2018-2766 ( NVD ): 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2018-2767 ( NVD ): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2018-2767 ( NVD ): 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2018-2771 ( SUSE ): 4.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2018-2771 ( NVD ): 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2018-2771 ( NVD ): 4.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2018-2781 ( SUSE ): 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2018-2781 ( NVD ): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2018-2781 ( NVD ): 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2018-2782 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-2782 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-2784 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-2784 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-2787 ( NVD ): 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CVE-2018-2787 ( NVD ): 5.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H CVE-2018-2813 ( SUSE ): 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2018-2813 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2018-2813 ( NVD ): 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2018-2817 ( SUSE ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-2817 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-2817 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-2819 ( SUSE ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-2819 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-2819 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2

An update that solves 12 vulnerabilities can now be installed.

Description:

MariaDB was updated to 10.0.35 (bsc#1090518)

Notable changes:

• PCRE updated to 8.42
• XtraDB updated to 5.6.39-83.1
• TokuDB updated to 5.6.39-83.1
• InnoDB updated to 5.6.40
• The embedded server library now supports SSL when connecting to remote servers [bsc#1088681], [CVE-2018-2767]
• MDEV-15249 - Crash in MVCC read after IMPORT TABLESPACE
• MDEV-14988 - innodb_read_only tries to modify files if transactions were recovered in COMMITTED state
• MDEV-14773 - DROP TABLE hangs for InnoDB table with FULLTEXT index
• MDEV-15723 - Crash in INFORMATION_SCHEMA.INNODB_SYS_TABLES when accessing corrupted record
• fixes for the following security vulnerabilities: CVE-2018-2782, CVE-2018-2784, CVE-2018-2787, CVE-2018-2766, CVE-2018-2755, CVE-2018-2819, CVE-2018-2817, CVE-2018-2761, CVE-2018-2781, CVE-2018-2771, CVE-2018-2813

• Release notes and changelog:

  • https://kb.askmonty.org/en/mariadb-10035-release-notes
  • https://kb.askmonty.org/en/mariadb-10035-changelog

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2018-1202=1
• SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-ESPOS-2018-1202=1

Package List:

• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (x86_64)
  • mariadb-debugsource-10.0.35-29.20.3
  • libmysqlclient18-32bit-10.0.35-29.20.3
  • mariadb-errormessages-10.0.35-29.20.3
  • libmysqlclient18-debuginfo-32bit-10.0.35-29.20.3
  • mariadb-client-10.0.35-29.20.3
  • mariadb-tools-debuginfo-10.0.35-29.20.3
  • libmysqlclient18-debuginfo-10.0.35-29.20.3
  • libmysqlclient18-10.0.35-29.20.3
  • mariadb-debuginfo-10.0.35-29.20.3
  • mariadb-client-debuginfo-10.0.35-29.20.3
  • mariadb-10.0.35-29.20.3
  • mariadb-tools-10.0.35-29.20.3
• SUSE Linux Enterprise Server 12 SP2 ESPOS 12-SP2 (x86_64)
  • mariadb-debugsource-10.0.35-29.20.3
  • libmysqlclient18-32bit-10.0.35-29.20.3
  • mariadb-errormessages-10.0.35-29.20.3
  • libmysqlclient18-debuginfo-32bit-10.0.35-29.20.3
  • mariadb-client-10.0.35-29.20.3
  • mariadb-tools-debuginfo-10.0.35-29.20.3
  • libmysqlclient18-debuginfo-10.0.35-29.20.3
  • libmysqlclient18-10.0.35-29.20.3
  • mariadb-debuginfo-10.0.35-29.20.3
  • mariadb-client-debuginfo-10.0.35-29.20.3
  • mariadb-10.0.35-29.20.3
  • mariadb-tools-10.0.35-29.20.3

References:

• https://www.suse.com/security/cve/CVE-2018-2755.html
• https://www.suse.com/security/cve/CVE-2018-2761.html
• https://www.suse.com/security/cve/CVE-2018-2766.html
• https://www.suse.com/security/cve/CVE-2018-2767.html
• https://www.suse.com/security/cve/CVE-2018-2771.html
• https://www.suse.com/security/cve/CVE-2018-2781.html
• https://www.suse.com/security/cve/CVE-2018-2782.html
• https://www.suse.com/security/cve/CVE-2018-2784.html
• https://www.suse.com/security/cve/CVE-2018-2787.html
• https://www.suse.com/security/cve/CVE-2018-2813.html
• https://www.suse.com/security/cve/CVE-2018-2817.html
• https://www.suse.com/security/cve/CVE-2018-2819.html
• https://bugzilla.suse.com/show_bug.cgi?id=1088681
• https://bugzilla.suse.com/show_bug.cgi?id=1090518