CVE-2017-10233 In MariaDB before 10.9.2, the CREATE DATABASE command failed to create a table with a unique constraint if the CREATE UNIQUE INDEX command failed, which allowed remote attackers to possibly obtain sensitive information by attempting to create multiple tables with the same name.
In MariaDB before 10.5.5, a denial of service (host memory allocation failure) could occur when parsing XAUTH data if an error occurs during handling of the length field.
In MariaDB before 10.5.5, an error in handling of XAUTH data could cause an assertion failure during XAUTH connection shutdown.
In MariaDB before 10.5.5, a length check error during XAUTH connection shutdown could cause an assertion failure.
In MariaDB before 10.5.5, a length check error during XAUTH connection shutdown could cause an assertion failure.
In MariaDB before 10.5.5, a length check error during XAUTH connection shutdown could cause an assertion failure.
In MariaDB before 10.5.5, a length check error during XAUTH connection shutdown could cause an assertion failure.
In MariaDB before 10.5.5, a length check error during XAUTH connection shutdown could cause an assertion failure.
In MariaDB before 10.5.5, a length check error during XAUTH connection
Vulnerabilities found in MariaDB
In MariaDB before 10.5.5, a length check error during XAUTH connection shutdown could cause an assertion failure.
In MariaDB before 10.5.5, a length check error during XAUTH connection shutdown could cause an assertion failure.
SQL injection vulnerability
A SQL injection vulnerability is the most common type of vulnerability that exists on websites. A SQL injection vulnerability allows an attacker to feed data in a format that will make it show up differently on the website than originally intended, which could be used to steal information from the site, cause it to perform unintended actions, or any other number of things.
In MariaDB before 10.7.0, this vulnerability allowed remote authenticated users to cause a denial-of-service condition or execute arbitrary code via a crafted VALUES clause (aka VALUES subquery) to the table of an unspecified table in the mysql database. The attackers can inject into other tables as well but not affect them.
In MariaDB before 10.5.5, this vulnerability allowed remote authenticated users with CREATE USER or CREATE DATABASE privileges to create databases owned by another user and gain elevated privileges via a crafted VALUES clause (aka VALUES subquery) in a GRANT statement for an unspecified table in the mysql database.
Timeline
Published on: 08/27/2022 20:15:00 UTC
Last modified on: 09/01/2022 19:35:00 UTC