Threats Tagged 'cve-2026-44172'

This update for mariadb-connector-c fixes the following issue: - CVE-2026-44172: mysql_real_escape_string() incorrectly handled big5 (bsc#1266438). Changes for mariadb-connector-c: - Update to release 3.4.9. - Update to release 3.4.8: * Fix compilation with GCC 15 * CONC-762: always set is_null and length in the bind structure to avoid msan errors * CONC-763: add MySQL collation ID 309 (utf8mb4_0900_bin) * CONC-764: fix build of ma_context.c on Android (X18 is a platform-reserved register) * CONC-766: disable clang -Wcast-function-type-strict for makecontext

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

This update includes the following RPMs: mariadb10.11: * mariadb10.11-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-backup-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-client-utils-10.11.18-1.hum1 (noarch) * mariadb10.11-common-10.11.18-1.hum1 (noarch) * mariadb10.11-connect-engine-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-cracklib-password-check-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-devel-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-embedded-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-embedded-devel-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-errmsg-10.11.18-1.hum1 (noarch) * mariadb10.11-gssapi-server-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-oqgraph-engine-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-pam-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-rocksdb-engine-10.11.18-1.hum1 (x86_64) * mariadb10.11-s3-engine-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-server-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-server-galera-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-server-utils-10.11.18-1.hum1 (noarch) * mariadb10.11-sphinx-engine-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-test-10.11.18-1.hum1 (aarch64, x86_64) * mariadb10.11-10.11.18-1.hum1.src (src)

This update includes the following RPMs: mariadb11.8: * mariadb-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-backup-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-client-utils-11.8.8-1.hum1 (noarch) * mariadb-common-11.8.8-1.hum1 (noarch) * mariadb-connect-engine-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-cracklib-password-check-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-devel-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-embedded-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-embedded-devel-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-errmsg-11.8.8-1.hum1 (noarch) * mariadb-gssapi-server-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-oqgraph-engine-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-pam-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-rocksdb-engine-11.8.8-1.hum1 (x86_64) * mariadb-s3-engine-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-server-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-server-galera-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-server-utils-11.8.8-1.hum1 (noarch) * mariadb-sphinx-engine-11.8.8-1.hum1 (aarch64, x86_64) * mariadb-test-11.8.8-1.hum1 (aarch64, x86_64) * mariadb11.8-11.8.8-1.hum1.src (src)

This security update for MariaDB addresses multiple vulnerabilities fixed in version 11.8.8. The issues include audit plugin bypass, optimizer vulnerability, authentication plugin crash, unsafe parameter handling in wsrep SST, authorization bypass exposing stored routines, argument injection via unsanitized URLs on Windows, path traversal, incorrect handling of character encoding, missing privilege checks on subqueries, and unsafe parameter handling in wsrep notify commands. These vulnerabilities collectively pose critical risks to database integrity, authorization, and stability.

A security update for MariaDB addresses multiple critical vulnerabilities affecting various components including audit plugin comment handling, wsrep SST parameter handling, argument injection via unsanitized URLs on Windows, path traversal in mbstream, improper handling of character encoding in mysql_real_escape_string(), missing privilege checks for FILE privilege in subqueries, and unsafe parameter handling in wsrep-related features. These issues are fixed in MariaDB version 10.6.27 as released by the SUSE Product Security Team. No known exploits in the wild have been reported at this time.