RHSA-2022:5948 Red Hat Security Advisory: galera, mariadb, and mysql-selinux security, bug fix, and enhancement update
mariadb: Crash executing query with VIEW, aggregate and subquery mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used mysql: C API unspecified vulnerability (CPU Oct 2022) mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer mariadb: lack of validating the existence of an object prior to performing operations on the object mariadb: lack of proper validation of a user-supplied string before using it as a format specifier mariadb: CONNECT storage engine heap-based buffer overflow mariadb: assertion failure in Item_args::walk_arg mariadb: use-after-poison when complex conversion is involved in blob mariadb: server crash in create_tmp_table::finalize mariadb: server crash in component arg_comparator::compare_real_fixed mariadb: server crash at my_decimal::operator= mariadb: server crash at Field::set_default via specially crafted SQL statements mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c mariadb: crash via component Item_subselect::init_expr_cache_tracker mariadb: server crashes in query_arena::set_query_arena upon SELECT from view mariadb: assertion failures in decimal_bin_size mariadb: crash when using HAVING with NOT EXIST predicate in an equality mariadb: assertion failure in compare_order_elements mariadb: crash when using HAVING with IS NULL predicate in an equality mariadb: use-after-poison in Binary_string::free_buffer mariadb: crash in multi-update and implicit grouping mariadb: assertion failure in sql/item_func.cc mariadb: crash via window function in expression in ORDER BY mariadb: assertion failure in sql/item_cmpfunc.cc mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc mariadb: incorrect key in "dup value" error after long unique mariadb: use-after-poison in Binary_string::free_buffer mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc mariadb: server crash at Item_subselect::init_expr_cache_tracker mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor mariadb: server crash in Item_field::fix_outer_field for INSERT SELECT mariadb: server crash in Item_args::walk_args mariadb: segmentation fault in Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort
CVSS v3.1 score: 6.5