GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
oesa-2022-1681
Vulnerability from osv_openeuler
Published
2022-05-28 11:04
Modified
2026-08-06 11:04
Summary
mariadb security update
Details

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27379)

MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.(CVE-2022-27386)

MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.(CVE-2022-27387)

An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27384)

An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27380)

MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.(CVE-2022-27383)

An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27381)

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.(CVE-2022-27377)

An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27378)

MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.(CVE-2022-27376)

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.(CVE-2022-27452)

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.(CVE-2022-27458)

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.(CVE-2022-27456)

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.(CVE-2022-27445)

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.(CVE-2022-27449)

There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.(CVE-2022-27448)

MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.(CVE-2022-27447)

An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27385)

MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.(CVE-2022-27382)

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.(CVE-2022-27451)

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c.(CVE-2022-27457)

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.(CVE-2022-27446)

MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.(CVE-2022-27444)

MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c.(CVE-2022-27455)

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "mariadb-server-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-server-galera-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-gssapi-server-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-embedded-devel-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-debugsource-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-test-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-devel-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-oqgraph-engine-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-errmessage-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-cracklib-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-debuginfo-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-embedded-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-backup-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-common-10.3.35-1.oe1.aarch64.rpm"
        ],
        "src": [
          "mariadb-10.3.35-1.oe1.src.rpm"
        ],
        "x86_64": [
          "mariadb-errmessage-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-test-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-debugsource-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-embedded-devel-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-backup-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-server-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-gssapi-server-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-server-galera-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-debuginfo-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-oqgraph-engine-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-common-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-embedded-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-cracklib-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-devel-10.3.35-1.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "mariadb",
        "purl": "pkg:rpm/openEuler/mariadb\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.3.35-1.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "mariadb-backup-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-cracklib-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-common-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-embedded-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-oqgraph-engine-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-server-galera-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-errmessage-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-debuginfo-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-devel-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-server-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-test-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-debugsource-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-gssapi-server-10.3.35-1.oe1.aarch64.rpm",
          "mariadb-embedded-devel-10.3.35-1.oe1.aarch64.rpm"
        ],
        "src": [
          "mariadb-10.3.35-1.oe1.src.rpm"
        ],
        "x86_64": [
          "mariadb-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-cracklib-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-server-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-oqgraph-engine-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-gssapi-server-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-test-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-errmessage-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-debuginfo-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-devel-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-server-galera-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-backup-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-embedded-devel-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-embedded-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-common-10.3.35-1.oe1.x86_64.rpm",
          "mariadb-debugsource-10.3.35-1.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP3",
        "name": "mariadb",
        "purl": "pkg:rpm/openEuler/mariadb\u0026distro=openEuler-20.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.3.35-1.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "mariadb-config-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-test-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-backup-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-debugsource-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-embedded-devel-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-rocksdb-engine-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-server-galera-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-server-utils-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-pam-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-embedded-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-errmsg-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-server-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-debuginfo-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-devel-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-gssapi-server-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-common-10.5.16-1.oe2203.aarch64.rpm",
          "mariadb-oqgraph-engine-10.5.16-1.oe2203.aarch64.rpm"
        ],
        "src": [
          "mariadb-10.5.16-1.oe2203.src.rpm"
        ],
        "x86_64": [
          "mariadb-devel-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-debuginfo-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-server-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-oqgraph-engine-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-common-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-gssapi-server-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-test-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-server-galera-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-debugsource-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-backup-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-config-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-server-utils-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-embedded-devel-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-embedded-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-errmsg-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-pam-10.5.16-1.oe2203.x86_64.rpm",
          "mariadb-10.5.16-1.oe2203.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS",
        "name": "mariadb",
        "purl": "pkg:rpm/openEuler/mariadb\u0026distro=openEuler-22.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.5.16-1.oe2203"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.\n\nSecurity Fix(es):\n\nAn issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27379)\n\nMariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.(CVE-2022-27386)\n\nMariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.(CVE-2022-27387)\n\nAn issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27384)\n\nAn issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27380)\n\nMariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.(CVE-2022-27383)\n\nAn issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27381)\n\nMariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.(CVE-2022-27377)\n\nAn issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27378)\n\nMariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.(CVE-2022-27376)\n\nMariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.(CVE-2022-27452)\n\nMariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.(CVE-2022-27458)\n\nMariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.(CVE-2022-27456)\n\nMariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.(CVE-2022-27445)\n\nMariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.(CVE-2022-27449)\n\nThere is an Assertion failure in MariaDB Server v10.9 and below via \u0026apos;node-\u0026gt;pcur-\u0026gt;rel_pos == BTR_PCUR_ON\u0026apos; at /row/row0mysql.cc.(CVE-2022-27448)\n\nMariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.(CVE-2022-27447)\n\nAn issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.(CVE-2022-27385)\n\nMariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.(CVE-2022-27382)\n\nMariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.(CVE-2022-27451)\n\nMariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c.(CVE-2022-27457)\n\nMariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.(CVE-2022-27446)\n\nMariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.(CVE-2022-27444)\n\nMariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c.(CVE-2022-27455)",
  "id": "OESA-2022-1681",
  "modified": "2026-08-06T11:04:57Z",
  "published": "2022-05-28T11:04:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1681"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27379"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27386"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27387"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27384"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27380"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27383"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27381"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27377"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27378"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27376"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27452"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27458"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27456"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27445"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27449"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27448"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27447"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27385"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27382"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27451"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27457"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27446"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27444"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27455"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mariadb security update",
  "upstream": [
    "CVE-2022-27379",
    "CVE-2022-27386",
    "CVE-2022-27387",
    "CVE-2022-27384",
    "CVE-2022-27380",
    "CVE-2022-27383",
    "CVE-2022-27381",
    "CVE-2022-27377",
    "CVE-2022-27378",
    "CVE-2022-27376",
    "CVE-2022-27452",
    "CVE-2022-27458",
    "CVE-2022-27456",
    "CVE-2022-27445",
    "CVE-2022-27449",
    "CVE-2022-27448",
    "CVE-2022-27447",
    "CVE-2022-27385",
    "CVE-2022-27382",
    "CVE-2022-27451",
    "CVE-2022-27457",
    "CVE-2022-27446",
    "CVE-2022-27444",
    "CVE-2022-27455"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.