—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:102
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : mariadb
Date : May 16, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in mariadb:

Unspecified vulnerability in the MySQL Server component in Oracle
MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote
authenticated users to affect availability via vectors related to XML
(CVE-2014-0384).

Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier
and 5.6.15 and earlier allows remote authenticated users to affect
availability via unknown vectors related to Partition (CVE-2014-2419).

Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier
and 5.6.16 and earlier allows remote authenticated users to affect
availability via unknown vectors related to Performance Schema
(CVE-2014-2430).

Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier
and 5.6.16 and earlier allows remote attackers to affect availability
via unknown vectors related to Options (CVE-2014-2431).

Unspecified vulnerability Oracle the MySQL Server component 5.5.35
and earlier and 5.6.15 and earlier allows remote authenticated users
to affect availability via unknown vectors related to Federated
(CVE-2014-2432).

Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier
and 5.6.16 and earlier allows remote authenticated users to affect
confidentiality, integrity, and availability via vectors related to
RBR (CVE-2014-2436).

Unspecified vulnerability in Oracle MySQL Server 5.5.35 and
earlier and 5.6.15 and earlier allows remote authenticated users
to affect availability via unknown vectors related to Replication
(CVE-2014-2438).

Unspecified vulnerability in the MySQL Client component in Oracle MySQL
5.5.36 and earlier and 5.6.16 and earlier allows remote attackers
to affect confidentiality, integrity, and availability via unknown
vectors (CVE-2014-2440).

The updated packages have been upgraded to the 5.5.37 version which
is not vulnerable to these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0384
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2419
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2430
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2431
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2432
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2436
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2438
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2440
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
https://mariadb.com/kb/en/mariadb-5537-changelog/
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
1fe72c87671f37b1b2f4b4996ec1127b mbs1/x86_64/lib64mariadb18-5.5.37-1.mbs1.x86_64.rpm
5ff88505068e9c671e463f5778258523 mbs1/x86_64/lib64mariadb-devel-5.5.37-1.mbs1.x86_64.rpm
bd1e7755996b75c9d463085db50036bf mbs1/x86_64/lib64mariadb-embedded18-5.5.37-1.mbs1.x86_64.rpm
a7083a72c547ac2f3b12de3918f9e439 mbs1/x86_64/lib64mariadb-embedded-devel-5.5.37-1.mbs1.x86_64.rpm
2283cf77d128f351b6a9d58b93b992a3 mbs1/x86_64/mariadb-5.5.37-1.mbs1.x86_64.rpm
e543e18cce1b02d9596a7ceaaebdaee4 mbs1/x86_64/mariadb-bench-5.5.37-1.mbs1.x86_64.rpm
0d00e0b9d6c5fd40f6509d04a6a92037 mbs1/x86_64/mariadb-client-5.5.37-1.mbs1.x86_64.rpm
562b44c1858f5facc3b369c82944b806 mbs1/x86_64/mariadb-common-5.5.37-1.mbs1.x86_64.rpm
f316c3a01c2d750fadd15cde37bed7f6 mbs1/x86_64/mariadb-common-core-5.5.37-1.mbs1.x86_64.rpm
c4b8e5b4b0011751fd1cfb815770cd4a mbs1/x86_64/mariadb-core-5.5.37-1.mbs1.x86_64.rpm
37d0b988bd9eece82be96611db7e9407 mbs1/x86_64/mariadb-extra-5.5.37-1.mbs1.x86_64.rpm
97a169abd022e7a1deadeb5889967092 mbs1/x86_64/mariadb-feedback-5.5.37-1.mbs1.x86_64.rpm
54d09552bc986687e856db4735aa4a6a mbs1/x86_64/mariadb-obsolete-5.5.37-1.mbs1.x86_64.rpm
6dd8cab60feda1483d6b478df7d4479a mbs1/x86_64/mysql-MariaDB-5.5.37-1.mbs1.x86_64.rpm
5cfc5ee42318dff700863d81f304ca8b mbs1/SRPMS/mariadb-5.5.37-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTdgEPmqjQ0CJFipgRAizeAKCJY74gT9w65y0pwx/i73329F2rwwCfWiKl
DYhWzB70Ym/FaIWyxIJqbvs=
=viSD
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________