The version of MariaDB installed on the remote host is prior to 5.5.59. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.59 advisory.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported     versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or     delete access to some of MySQL Server accessible data. (CVE-2018-2562)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported     versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-2622)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported     versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-2640, CVE-2018-2665,     CVE-2018-2668)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported     versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior.
    Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols     to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2018-3133)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the mysql package has been released.

This update for mariadb to 10.0.34 fixes several issues. These security issues were fixed :

  - CVE-2017-10378: Vulnerability in subcomponent: Server:
    Optimizer. Easily exploitable vulnerability allowed low     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete     DOS) (bsc#1064115).

  - CVE-2017-10268: Vulnerability in subcomponent: Server:
    Replication. Difficult to exploit vulnerability allowed     high privileged attacker with logon to the     infrastructure where MySQL Server executes to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized access to critical data or     complete access to all MySQL Server accessible data     (bsc#1064101).

  - CVE-2018-2562: Vulnerability in the MySQL Server     subcomponent: Server : Partition. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server as well as unauthorized update, insert or delete     access to some of MySQL Server accessible data.

  - CVE-2018-2622: Vulnerability in the MySQL Server     subcomponent: Server: DDL. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server.

  - CVE-2018-2640: Vulnerability in the MySQL Server     subcomponent: Server: Optimizer. Successful attacks of     this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server.

  - CVE-2018-2665: Vulnerability in the MySQL Server     subcomponent: Server: Optimizer. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server.

  - CVE-2018-2668: Vulnerability in the MySQL Server     subcomponent: Server: Optimizer. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server.

  - CVE-2018-2612: Vulnerability in the MySQL Server     subcomponent: InnoDB. Easily exploitable vulnerability     allowed high privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access     to critical data or all MySQL Server accessible data and     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mariadb fixes the following issues :

MariaDB was updated to 10.0.34 (bsc#1078431)

The following security vulnerabilities are fixed :

  - CVE-2018-2562: Vulnerability in the MySQL Server     subcomponent: Server : Partition. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server as well as unauthorized update, insert or delete     access to some of MySQL Server accessible data.

  - CVE-2018-2622: Vulnerability in the MySQL Server     subcomponent: Server: DDL. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server.

  - CVE-2018-2640: Vulnerability in the MySQL Server     subcomponent: Server: Optimizer. Successful attacks of     this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server.

  - CVE-2018-2665: Vulnerability in the MySQL Server     subcomponent: Server: Optimizer. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server.

  - CVE-2018-2668: Vulnerability in the MySQL Server     subcomponent: Server: Optimizer. Easily exploitable     vulnerability allowed low privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server.

  - CVE-2018-2612: Vulnerability in the MySQL Server     subcomponent: InnoDB. Easily exploitable vulnerability     allowed high privileged attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access     to critical data or all MySQL Server accessible data and     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server.

The MariaDB external release notes and changelog for this release :

- https://kb.askmonty.org/en/mariadb-10034-release-notes

- https://kb.askmonty.org/en/mariadb-10034-changelog

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.59, which includes additional changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details :

https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-59.html http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628 .html

For Debian 7 'Wheezy', these problems have been fixed in version 5.5.59-0+deb7u1.

We recommend that you upgrade your mysql-5.5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**MariaDB 10.2.13**

Release notes :

https://mariadb.com/kb/en/library/mariadb-10213-release-notes/

CVEs fixed :

CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668

Bugs fixed :

POSTIN scriplets fix for:
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4a4dc47afe

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2637:01 advisory.

    * mysql: sha256_password authentication DoS via long password (CVE-2018-2696)
    * mysql: Server: InnoDB unspecified vulnerability (CPU Jan 2018) (CVE-2018-2565)
    * mysql: Server: GIS unspecified vulnerability (CPU Jan 2018) (CVE-2018-2573)
    * mysql: Server: DML unspecified vulnerability (CPU Jan 2018) (CVE-2018-2576)
    * mysql: Stored Procedure unspecified vulnerability (CPU Jan 2018)     (CVE-2018-2583)
    * mysql: Server: DML unspecified vulnerability (CPU Jan 2018) (CVE-2018-2586)
    * mysql: Server: Performance Schema unspecified vulnerability (CPU Jan 2018)     (CVE-2018-2590)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018)     (CVE-2018-2600)
    * mysql: InnoDB unspecified vulnerability (CPU Jan 2018) (CVE-2018-2612)
    * mysql: Server: DDL unspecified vulnerability (CPU Jan 2018) (CVE-2018-2622)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018)     (CVE-2018-2640)
    * mysql: Server: Performance Schema unspecified vulnerability (CPU Jan 2018)     (CVE-2018-2645)
    * mysql: Server: DML unspecified vulnerability (CPU Jan 2018) (CVE-2018-2646)
    * mysql: Server: Replication unspecified vulnerability (CPU Jan 2018)     (CVE-2018-2647)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018)     (CVE-2018-2665)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018)     (CVE-2018-2667)
    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2018)     (CVE-2018-2668)
    * mysql: sha256_password authentication DoS via hash with large rounds value     (CVE-2018-2703)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.39. It is, therefore, affected by multiple vulnerabilities as noted in the January 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
167876	MariaDB 5.5.0 < 5.5.59 Multiple Vulnerabilities	Nessus	Databases	2022/11/18	2026/1/29	high
203058	Photon OS 2.0: Mysql PHSA-2018-2.0-0037	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	medium
108402	SUSE SLES12 Security Update : mariadb (SUSE-SU-2018:0698-1)	Nessus	SuSE Local Security Checks	2018/3/16	2025/1/30	high
108439	openSUSE Security Update : mariadb (openSUSE-2018-270)	Nessus	SuSE Local Security Checks	2018/3/19	2025/1/29	high
106206	Debian DLA-1250-1 : mysql-5.5 security update	Nessus	Debian Local Security Checks	2018/1/22	2025/11/3	high
120576	Fedora 28 : 3:mariadb (2018-83bbd0c22f)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	high
289341	MiracleLinux 7 : rh-mysql57-mysql-5.7.21-2.el7.1 (AXSA:2018-2637:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium
106100	MySQL 5.6.x < 5.6.39 Multiple Vulnerabilities (RPM Check) (January 2018 CPU)	Nessus	Databases	2018/1/17	2025/11/3	high
106099	MySQL 5.6.x < 5.6.39 Multiple Vulnerabilities (January 2018 CPU)	Nessus	Databases	2018/1/17	2025/11/3	high

检测

插件搜索

high

medium

high

high

high

high

medium

high

high