Bug 580834 – <dev-db/mariadb-{5.5.49,10.0.25,10.1.12}: multiple vulnerabilities (CVE-2016-{0640,0641,0642,0643,0644,0646,0647,0648,0649,0650,0651,0655,0666,0668})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Brian Evans (RETIRED) 2016-04-22 13:47:08 UTC]

A security update of mariadb described at $URL

[Comment 1 Tomáš Mózes 2016-05-18 05:06:11 UTC]

Version 10.0.25 seems fine, tested in production on amd64.

[Comment 2 Brian Evans (RETIRED) 2016-05-19 17:09:36 UTC]

Arches, please test and mark stable.
The test suite should pass following the official instructions.
Local timeouts may be expected on resource starved machines. (each test thread can spawn up to 4 server instances)

Target keywords:
=dev-db/mariadb-10.0.25 alpha amd64 arm hppa ia64 ppc ppc64 sparc x86

# Official test instructions:
# USE='embedded extraengine perl server openssl static-libs' \
# FEATURES='test userpriv -usersandbox' \
# ebuild mariadb-X.X.XX.ebuild \
# digest clean package

# Parallel testing is enabled, auto will try to detect number of cores
# You may set this by hand.
# The default maximum is 8 unless MTR_MAX_PARALLEL is increased
export MTR_PARALLEL="${MTR_PARALLEL:-auto}"

[Comment 3 Jeroen Roovers (RETIRED) 2016-05-20 11:05:55 UTC]

Stable for HPPA PPC64.

[Comment 4 Tobias Klausmann (RETIRED) 2016-05-21 12:59:07 UTC]

Stable on alpha.

[Comment 5 Markus Meier 2016-05-24 20:10:49 UTC]

arm stable

[Comment 6 Agostino Sarubbo 2016-05-25 09:49:40 UTC]

amd64 stable

[Comment 7 Agostino Sarubbo 2016-05-25 11:27:25 UTC]

x86 stable

[Comment 8 Agostino Sarubbo 2016-07-08 08:18:57 UTC]

ppc stable

[Comment 9 Agostino Sarubbo 2016-07-08 08:43:18 UTC]

sparc stable

[Comment 10 Agostino Sarubbo 2016-07-08 13:29:21 UTC]

ia64 stable.

Maintainer(s), please cleanup.

[Comment 11 Brian Evans (RETIRED) 2016-07-21 17:53:48 UTC]

Cleanup is done

[Comment 12 GLSAMaker/CVETool Bot 2016-07-23 01:35:54 UTC]

CVE-2016-0668 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0668):
  Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and
  earlier allows local users to affect availability via vectors related to
  InnoDB.

CVE-2016-0655 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0655):
  Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and
  earlier allows local users to affect availability via vectors related to
  InnoDB.

CVE-2016-0651 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0651):
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local
  users to affect availability via vectors related to Optimizer.

CVE-2016-0650 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0650):
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier allows local users to affect availability
  via vectors related to Replication.

CVE-2016-0649 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0649):
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier allows local users to affect availability
  via vectors related to PS.

CVE-2016-0648 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0648):
  Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and
  earlier, and 5.7.11 and earlier allows local users to affect availability
  via vectors related to PS.

CVE-2016-0647 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0647):
  Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and
  earlier, and 5.7.11 and earlier allows local users to affect availability
  via vectors related to FTS.

CVE-2016-0646 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0646):
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier allows local users to affect availability
  via vectors related to DML.

CVE-2016-0644 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0644):
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier allows local users to affect availability
  via vectors related to DDL.

CVE-2016-0643 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0643):
  Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and
  earlier, and 5.7.11 and earlier allows local users to affect confidentiality
  via vectors related to DML.

CVE-2016-0642 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0642):
  Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and
  earlier, and 5.7.11 and earlier allows local users to affect integrity and
  availability via vectors related to Federated.

CVE-2016-0641 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0641):
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier allows local users to affect confidentiality
  and availability via vectors related to MyISAM.

CVE-2016-0640 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0640):
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier allows local users to affect integrity and
  availability via vectors related to DML.

[Comment 13 Aaron Bauman (RETIRED) 2016-07-23 01:38:33 UTC]

Added to existing GLSA.

[Comment 14 GLSAMaker/CVETool Bot 2016-10-11 13:46:01 UTC]

This issue was resolved and addressed in
 GLSA 201610-06 at https://security.gentoo.org/glsa/201610-06
by GLSA coordinator Aaron Bauman (b-man).