SB20240806379 - Amazon Linux AMI update for mariadb105
Published: August 6, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Improper Resource Shutdown or Release (CVE-ID: CVE-2022-31622)
The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.
The vulnerability exists due to error in the extra/mariabackup/ds_compress.cc. A local user can exploit this vulnerability to cause a deadlock, resulting in a denial of service condition.
2) Improper locking (CVE-ID: CVE-2022-31623)
The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.
The vulnerability exists due to double-locking error in the extra/mariabackup/ds_compress.cc. A local user can exploit this vulnerability to cause a deadlock, resulting in a denial of service condition.
3) Buffer overflow (CVE-ID: CVE-2022-32091)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to a use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. A local user can create a specially crafted file and execute arbitrary code on the target system.
4) Resource management error (CVE-ID: CVE-2022-38791)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to compress_write() function in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure. A local user can trigger a deadlock and perform a denial of service (DoS) attack.
5) NULL pointer dereference (CVE-ID: CVE-2022-47015)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the spider_db_mbase::print_warnings() function. A remote user can pass specially crafted data to the server and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.