MariaDB Prior to 5.5.35 Remote Multiple Denial of Service Vulnerabilities

Bugtraq ID:	65757
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Feb 24 2014 12:00AM
Updated:	Feb 24 2014 12:00AM
Credit:	Elena Stepanova,Peter (Stig) Edwards,Vasilis Lourdas, MariaDB.
Vulnerable:
Not Vulnerable:

MariaDB Prior to 5.5.35 Remote Multiple Denial of Service Vulnerabilities

MariaDB is prone to multiple denial-of-service vulnerabilities.

Attackers can exploit these issues to crash the server, resulting in a denial-of-service condition. Other attacks may be possible.

Versions prior to MairaDB 5.5.36 are vulnerable.

MariaDB Prior to 5.5.35 Remote Multiple Denial of Service Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

MariaDB Prior to 5.5.35 Remote Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

MariaDB Prior to 5.5.35 Remote Multiple Denial of Service Vulnerabilities

References:

• Assertion `! is_set()' fails on PREPARE SELECT with out of range in GROUP BY (MariaDB)
  
• Failing assertion: state == TRX_STATE_NOT_STARTED on concurrent CREATE OR REPLAC (MariaDB)
  
• LP:1020645 - crash (sig 11) with union query (MariaDB)
  
• MariaDB 5.5.36 Changelog (MariaDB)
  
• MariaDB 5.5.36 Release Notes (MariaDB)
  
• MariaDB Homepage (Monty Program Ab)
  
• mysqld crashes when running a query with ONLY_FULL_GROUP_BY (MariaDB)
  
• Server crashes in in JOIN::prepare on 2nd execution of PS with materialization+s (MariaDB)
  
• Server crashes on NAME_CONST containing AND/OR expressions (MariaDB)