{"id":"MGASA-2025-0186","summary":"Updated mariadb packages fix security vulnerabilities","details":"MariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through\n10.11.*, and 11.0 through 11.0.* can sometimes crash with an empty\nbacktrace log. This may be related to make_aggr_tables_info and\noptimize_stage2 - CVE-2023-52969.\nMariaDB Server 10.4 through 10.5.*, 10.6 through 10.6.*, 10.7 through\n10.11.*, 11.0 through 11.0.*, and 11.1 through 11.4.* crashes in\nItem_direct_view_ref::derived_field_transformer_for_where -\nCVE-2023-52970.\nMariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in\nJOIN::fix_all_splittings_in_plan - CVE-2023-52971.\nVulnerability in the MySQL Server product of Oracle MySQL (component:\nInnoDB). Supported versions that are affected are 8.0.0-8.0.41,\n8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows\nhigh privileged attacker with network access via multiple protocols to\ncompromise MySQL Server. Successful attacks of this vulnerability can\nresult in unauthorized ability to cause a hang or frequently repeatable\ncrash (complete DOS) of MySQL Server as well as unauthorized update,\ninsert or delete access to some of MySQL Server accessible data. CVSS\n3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector:\n(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) - CVE-2025-30693.\nVulnerability in the MySQL Client product of Oracle MySQL (component:\nClient: mysqldump). Supported versions that are affected are\n8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit\nvulnerability allows low privileged attacker with network access via\nmultiple protocols to compromise MySQL Client. Successful attacks of\nthis vulnerability can result in unauthorized access to critical data or\ncomplete access to all MySQL Client accessible data as well as\nunauthorized update, insert or delete access to some of MySQL Client\naccessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity\nimpacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) -\nCVE-2025-30722\n","modified":"2026-04-16T00:12:44.163657389Z","published":"2025-06-11T17:43:45Z","upstream":["CVE-2023-52969","CVE-2023-52970","CVE-2023-52971","CVE-2025-30693","CVE-2025-30722"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2025-0186.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=34342"},{"type":"WEB","url":"https://mariadb.com/kb/en/mariadb-11-4-7-release-notes/"},{"type":"WEB","url":"https://mariadb.com/kb/en/mariadb-11-4-6-release-notes/"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-7548-1"}],"affected":[{"package":{"name":"mariadb","ecosystem":"Mageia:9","purl":"pkg:rpm/mageia/mariadb?arch=source&distro=mageia-9"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.7-1.mga9"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2025-0186.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}