Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2140
mariadb-10.1 security update
28 August 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: mariadb-10.1
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Modify Arbitrary Files -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-3653 CVE-2017-3641 CVE-2017-3636
Reference: ASB-2017.0109
ESB-2017.2059
ESB-2017.1856
ESB-2017.1819
ESB-2017.1801
Original Bulletin:
http://www.debian.org/security/2017/dsa-3955
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3955-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
August 26, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : mariadb-10.1
CVE ID : CVE-2017-3636 CVE-2017-3641 CVE-2017-3653
Several issues have been discovered in the MariaDB database server. The
vulnerabilities are addressed by upgrading MariaDB to the new upstream
version 10.1.26. Please see the MariaDB 10.1 Release Notes for further
details:
https://mariadb.com/kb/en/mariadb/mariadb-10124-release-notes/
https://mariadb.com/kb/en/mariadb/mariadb-10125-release-notes/
https://mariadb.com/kb/en/mariadb/mariadb-10126-release-notes/
For the stable distribution (stretch), these problems have been fixed in
version 10.1.26-0+deb9u1.
For the unstable distribution (sid), these problems have been fixed in
version 10.1.26-1.
We recommend that you upgrade your mariadb-10.1 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlmhfxVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0S82g//T4ZMPjvaMO8MJlqQ0Wv9iFJRvkv49YiLdNojO8h78133SiP/TifmjgR1
9rjK1cBE0NzurG/32LOXtZLv9tuy2+8iwOq8LNioF5dFAoYBmcqpgcsIe6RYBngN
taVWAQTgJjflDHXr7hHueTBVr00vLZ+opzd+71KFVyTRGHENfpGsHgv3VmucNrlv
/hwMvZlZ7+oEDUKiehtyBDnjji/ZJ5Id+yGT8zeD7cfDECIfKcgOI96xkpyutrOz
K2BZEKxP74naq1PJQrrzWGnFWICrQkYpTuPmXnTJCVmHLux+CTy91zQjDbIjgEkN
zqRsiIbE9vRKbX5t0YGCzfy4sYZyC8bxUq2nW2arigPTlgMemRcUVteKCXfrpZQH
EMk19lhJVUF1ntNJ5DZFgmZQ34QCeFtswETu1MT/CbJ6a6x2DTPUQaP/QwtRBSNG
Bdvq20iE7Ef+9UL8NB5qJ9JeYLG76eplv0GfHFxhaB0PKW+1Vz9IMIF9HIFa/pnl
LcLCYSmGUYsyUsSXYkYiBoY3ZJKABm+1lyCKvFg0X0B2yNNbHUYM1ROnpxjGz3Hv
AkLt23Jq6HjeArTJao0VdTh5uEncaObwIltZhQuccAedVMXH9/isL6hp6NsCV15h
PKr8lzZRkTqBLJShyjmoFT9GaQXdTEQnm7XTOhFUUOLZoRx0Z+0=
=H/hD
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWaN61ox+lLeg9Ub1AQgg2RAAiKlvwnMlOqMruna8VTlu5ji3qSC1Fdd9
funOlcZ0+9t19GMSXYr5zRjm9jYq1mYyDXSaonkxRW0/xtputAROXEokSmte4ba4
R7kUnmHs4gHZgYVQH9jlSGuRb4WNvOtjoRY8UvAS9FeF9Wa5suvB441x0kIziHYU
1//41zCaYZw8F0xqL9IC7ZIwBLii9mEzLQvjcd0qYiKuPDj8mcKHnQqwKwvgmQnl
F6Af++D6uIlwk8u+aZjW64QNN7wxiC01PoEJFtwqFhZlY4fLofZovxwu6e9kFrPL
xzdpJcqZIlPAcGg4RXNvTOzQW5OeGbNNrfPS/X3rqIKXVRk1CRSfk3BXvMOfUr7j
htpblUQry5BC06cCk3iTKvLhJpxNn3K6BGyZbonti5M+krbKG5N6uuOFWdeK6bnJ
fUpUYyUcvIqg0lP4cXbdSJkypiBklrE7ZFZ0lymYoERBQ8W4SdyovUWGbsHmpOhL
26+AYV2ISPNLfpcJp8YTJ7RT0qH6f78d+PXPYAphAUYNpWVmy+4tjdNxHLowCDii
jq2NsdfQLfHdjOHA58YGC5dpCUZlZBdKQPPP/cnQwo3yhBMYYlw51JB/R+/Ola4h
Km23HmxdQej7uhe1ZV892AwI4fuNWNLzjHQVJHeo/Q9lvqPiUpt1cQQBJb/B3Ldy
NOSeOmnXIOM=
=LUOG
-----END PGP SIGNATURE-----