Global Buffer Overflow in MariaDB Server v10.7 and Below
Summary
CVE-2022-27387: MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements. Affects mariadb across 2 version ranges.
< 10.4.25-r0
>= 9664240c948a92c22ccda0e1f5a420eb776ddcb1, < 0ba528fe56f6c637d9fbc9d177a62610038fd519
Fixed in 10.4.25-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB Server is an open-source relational database management system that is a drop-in replacement for MySQL. It provides a wide range of features and is widely used in various applications. However, versions 10.7 and below of MariaDB Server are vulnerable to a global buffer overflow in the component decimal_bin_size. This vulnerability can be exploited through specially crafted SQL statements.
Vulnerability Detail
The global buffer overflow vulnerability in MariaDB Server v10.7 and below occurs in the decimal_bin_size component. Attackers can exploit this vulnerability by sending specially crafted SQL statements to the server. If successful, this can lead to arbitrary code execution or denial of service. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
10.4.25-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update MariaDB Server to the fixed versions mentioned above.
Conclusion
In conclusion, MariaDB Server versions 10.7 and below are vulnerable to a global buffer overflow in the decimal_bin_size component. It is crucial to update to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mariadb →
FAQ
MariaDB Server is an open-source relational database management system and a drop-in replacement for MySQL.
Versions 10.7 and below of MariaDB Server are affected by this vulnerability.
The vulnerability can be exploited by sending specially crafted SQL statements to the server.
Successful exploitation of this vulnerability can lead to arbitrary code execution or denial of service.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
