mariadb (SUSE:Linux Enterprise Server 12 SP5) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 12 SP5 package mariadb, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (50)

• CVE-2020-15180 — CVSS 9.0 (critical): A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection…
• CVE-2020-13249 — CVSS 8.8 (high): libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server…
• CVE-2022-24048 — CVSS 7.8 (high): MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to…
• CVE-2022-24051 — CVSS 7.8 (high): MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate…
• CVE-2022-24050 — CVSS 7.8 (high): MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate…
• CVE-2022-24052 — CVSS 7.8 (high): MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to…
• CVE-2022-27384 — CVSS 7.5 (high): An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to…
• CVE-2022-27383 — CVSS 7.5 (high): MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via…
• CVE-2022-27378 — CVSS 7.5 (high): An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial…
• CVE-2022-27381 — CVSS 7.5 (high): An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of…
• CVE-2022-27380 — CVSS 7.5 (high): An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of…
• CVE-2022-27445 — CVSS 7.5 (high): MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.
• CVE-2022-32084 — CVSS 7.5 (high): MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.
• CVE-2022-27387 — CVSS 7.5 (high): MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via…
• CVE-2022-27377 — CVSS 7.5 (high): MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited…
• CVE-2022-27386 — CVSS 7.5 (high): MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.
• CVE-2021-46669 — CVSS 7.5 (high): MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used.
• CVE-2021-27928 — CVSS 7.2 (high): A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before…
• CVE-2020-14765 — CVSS 6.5 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and…
• CVE-2019-2974 — CVSS 6.5 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.45…
• CVE-2019-2805 — CVSS 6.5 (medium): Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.44…
• CVE-2019-2740 — CVSS 6.5 (medium): Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported versions that are affected are 5.6.44…
• CVE-2020-2574 — CVSS 5.9 (medium): Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior…
• CVE-2021-2389 — CVSS 5.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior…
• CVE-2021-46664 — CVSS 5.5 (medium): MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.
• CVE-2019-2758 — CVSS 5.5 (medium): Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.26 and…
• CVE-2020-2760 — CVSS 5.5 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.29 and prior…
• CVE-2021-35604 — CVSS 5.5 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.35 and prior…
• CVE-2021-46657 — CVSS 5.5 (medium): get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.
• CVE-2021-46658 — CVSS 5.5 (medium): save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for…
• CVE-2021-46659 — CVSS 5.5 (medium): MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.
• CVE-2021-46661 — CVSS 5.5 (medium): MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression…
• CVE-2021-46663 — CVSS 5.5 (medium): MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.
• CVE-2021-46665 — CVSS 5.5 (medium): MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.
• CVE-2021-46668 — CVSS 5.5 (medium): MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine…
• CVE-2020-2752 — CVSS 5.3 (medium): Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior…
• CVE-2019-2739 — CVSS 5.1 (medium): Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are…
• CVE-2019-18901 — CVSS 5.1 (medium): A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server…
• CVE-2021-2154 — CVSS 4.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and…
• CVE-2020-2814 — CVSS 4.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.47 and prior…
• CVE-2020-2812 — CVSS 4.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are…
• CVE-2020-14812 — CVSS 4.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 5.6.49 and…
• CVE-2020-14789 — CVSS 4.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.31 and…
• CVE-2020-14776 — CVSS 4.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.31 and prior…
• CVE-2019-2737 — CVSS 4.9 (medium): Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected…
• CVE-2021-2180 — CVSS 4.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior…
• CVE-2021-2166 — CVSS 4.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and…
• CVE-2022-21427 — CVSS 4.9 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.37 and…
• CVE-2021-2372 — CVSS 4.4 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior…
• CVE-2019-2938 — CVSS 4.4 (medium): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior…