This update for mariadb fixes the following issues :

  - CVE-2016-3477: Unspecified vulnerability in subcomponent     parser [bsc#991616]

  - CVE-2016-3521: Unspecified vulnerability in subcomponent     types [bsc#991616]

  - CVE-2016-3615: Unspecified vulnerability in subcomponent     dml [bsc#991616]

  - CVE-2016-5440: Unspecified vulnerability in subcomponent     rbr [bsc#991616]

  - mariadb failing test main.bootstrap [bsc#984858]

  - left over 'openSUSE' comments in MariaDB on SLE12 GM and     SP1 [bsc#985217]

  - remove unnecessary conditionals from specfile

  - add '--ignore-db-dir=lost+found' option to     rc.mysql-multi in order not to misinterpret the     lost+found directory as a database [bsc#986251]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

mysql-community-server was updated to 5.6.34 to fix the following issues :

  - Changes     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     34.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     33.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     32.html     http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-     31.html

  - fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440,     CVE-2016-5584, CVE-2016-5617, CVE-2016-5616,     CVE-2016-5626, CVE-2016-3492, CVE-2016-5629,     CVE-2016-5507, CVE-2016-8283, CVE-2016-5609,     CVE-2016-5612, CVE-2016-5627, CVE-2016-5630,     CVE-2016-8284, CVE-2016-8288, CVE-2016-3477,     CVE-2016-2105, CVE-2016-3486, CVE-2016-3501,     CVE-2016-3521, CVE-2016-3615, CVE-2016-3614,     CVE-2016-3459, CVE-2016-5439, CVE-2016-5440

  - fixes SUSE Bugs: [boo#999666], [boo#998309],     [boo#1005581], [boo#1005558], [boo#1005563],     [boo#1005562], [boo#1005566], [boo#1005555],     [boo#1005569], [boo#1005557], [boo#1005582],     [boo#1005560], [boo#1005561], [boo#1005567],     [boo#1005570], [boo#1005583], [boo#1005586],     [boo#989913], [boo#977614], [boo#989914], [boo#989915],     [boo#989919], [boo#989922], [boo#989921], [boo#989911],     [boo#989925], [boo#989926]

  - append '--ignore-db-dir=lost+found' to the mysqld     options in 'mysql-systemd-helper' script if 'lost+found'     directory is found in $datadir [boo#986251] 

  - remove syslog.target from *.service files [boo#983938]

  - add systemd to deps to build on leap and friends 

  - replace '%(_libexecdir)/systemd/system' with %(_unitdir)     macro

  - remove useless mysql@default.service [boo#971456]

  - replace all occurrences of the string '@sysconfdir@'     with '/etc' in     mysql-community-server-5.6.3-logrotate.patch as it     wasn't expanded properly [boo#990890]

  - remove '%define _rundir' as 13.1 is out of support scope

  - run 'usermod -g mysql mysql' only if mysql user is not     in mysql group. Run 'usermod -s /bin/false/ mysql' only     if mysql user doesn't have '/bin/false' shell set.

  - re-enable mysql profiling

According to the versions of the mariadb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - MariaDB is a community developed branch of MySQL.
    MariaDB is a multi-user, multi-threaded SQL database     server. It is a client/server implementation consisting     of a server daemon (mysqld) and many different client     programs and libraries. The base package contains the     standard MariaDB/MySQL client programs and generic     MySQL files.

  - Security Fix(es)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     integrity and availability via vectors related to     DML.(CVE-2016-0640)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     confidentiality and availability via vectors related to     MyISAM.(CVE-2016-0641)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     confidentiality via vectors related to     DML.(CVE-2016-0643)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to DDL.(CVE-2016-0644)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to DML.(CVE-2016-0646)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     availability via vectors related to FTS.(CVE-2016-0647)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     availability via vectors related to PS.(CVE-2016-0648)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to PS.(CVE-2016-0649)

  - Unspecified vulnerability in Oracle MySQL 5.5.47 and     earlier, 5.6.28 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.48, 10.0.x before 10.0.24, and     10.1.x before 10.1.12 allows local users to affect     availability via vectors related to     Replication.(CVE-2016-0650)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows local users to affect     availability via vectors related to Security:
    Privileges.(CVE-2016-0666)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.10 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows remote attackers to affect     confidentiality via vectors related to Server:
    Security: Encryption.(CVE-2016-3452)

  - Unspecified vulnerability in Oracle MySQL 5.5.49 and     earlier, 5.6.30 and earlier, and 5.7.12 and earlier and     MariaDB before 5.5.50, 10.0.x before 10.0.26, and     10.1.x before 10.1.15 allows local users to affect     confidentiality, integrity, and availability via     vectors related to Server: Parser.(CVE-2016-3477)

  - Unspecified vulnerability in Oracle MySQL 5.5.49 and     earlier, 5.6.30 and earlier, and 5.7.12 and earlier and     MariaDB before 5.5.50, 10.0.x before 10.0.26, and     10.1.x before 10.1.15 allows remote authenticated users     to affect availability via vectors related to Server:
    Types.(CVE-2016-3521)

  - Unspecified vulnerability in Oracle MySQL 5.5.49 and     earlier, 5.6.30 and earlier, and 5.7.12 and earlier and     MariaDB before 5.5.50, 10.0.x before 10.0.26, and     10.1.x before 10.1.15 allows remote authenticated users     to affect availability via vectors related to Server:
    DML.(CVE-2016-3615)

  - Unspecified vulnerability in Oracle MySQL 5.5.49 and     earlier, 5.6.30 and earlier, and 5.7.12 and earlier and     MariaDB before 5.5.50, 10.0.x before 10.0.26, and     10.1.x before 10.1.15 allows remote administrators to     affect availability via vectors related to Server:
    RBR.(CVE-2016-5440)

  - Unspecified vulnerability in Oracle MySQL 5.5.48 and     earlier, 5.6.29 and earlier, and 5.7.11 and earlier and     MariaDB before 5.5.49, 10.0.x before 10.0.25, and     10.1.x before 10.1.14 allows remote attackers to affect     confidentiality via vectors related to Server:
    Connection.(CVE-2016-5444)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93368	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:2218-1)	Nessus	SuSE Local Security Checks	2016/9/8	2026/1/27	high
93372	SUSE SLES12 Security Update : mariadb (SUSE-SU-2016:2248-1)	Nessus	SuSE Local Security Checks	2016/9/8	2026/1/27	high
94756	openSUSE Security Update : mysql-community-server (openSUSE-2016-1289)	Nessus	SuSE Local Security Checks	2016/11/14	2026/1/19	critical
99798	EulerOS 2.0 SP1 : mariadb (EulerOS-SA-2016-1035)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	high

检测

插件搜索

high

high

critical

high