-
mariadb-10.0 (10.0.25-0ubuntu0.15.10.1) wily-security; urgency=low
* SECURITY UPDATE: New upstream release 10.0.25. Includes fixes for the
following security vulnerabilities (LP: #1589302):
- CVE-2016-0666
- CVE-2016-0655
- CVE-2016-0648
- CVE-2016-0647
- CVE-2016-0643
* Includes fixes done in 10.0.24 for the following security vulnerabilities:
- CVE-2016-0668
- CVE-2016-0650
- CVE-2016-0649
- CVE-2016-0646
- CVE-2016-0644
- CVE-2016-0641
- CVE-2016-0640
* Updated old changelog entries to include new CVE identifiers.
* Upstream included changes to logrotate script that supports systems that
has multiple mysqld processes running.
* Upstream included bugfix to mariadb-server-10.0 postinstall.
-- Otto Kekäläinen <email address hidden> Tue, 07 Jun 2016 23:30:35 +0300
-
mariadb-10.0 (10.0.23-0ubuntu0.15.10.1) wily-security; urgency=low
* SECURITY UPDATE: Update to 10.0.23 fixes security issues (LP: #1538315):
- CVE-2016-2047
- CVE-2016-0616
- CVE-2016-0609
- CVE-2016-0608
- CVE-2016-0606
- CVE-2016-0600
- CVE-2016-0598
- CVE-2016-0597
- CVE-2016-0596
- CVE-2016-0546
- CVE-2016-0505
* Update TokuDB plugin install and copyright paths to match latest
release done under Percona ownership
-- Otto Kekäläinen <email address hidden> Tue, 26 Jan 2016 23:59:51 +0200
-
mariadb-10.0 (10.0.22-0ubuntu0.15.10.1) wily-security; urgency=low
* SECURITY UPDATE: Update to 10.0.22 fixes security issues:
(LP: #1512241)
- CVE-2015-4802
- CVE-2015-4807
- CVE-2015-4815
- CVE-2015-4826
- CVE-2015-4830
- CVE-2015-4836
- CVE-2015-4858
- CVE-2015-4861
- CVE-2015-4870
- CVE-2015-4913
- CVE-2015-4792
* Includes security issues fixed in 10.0.21:
- CVE-2015-4816
- CVE-2015-4819
- CVE-2015-4879
- CVE-2015-4895
(LP: #1512241)
* Upstream changed mysqld_safe_syslog.cnf to fix logging error
-- Otto Kekäläinen <email address hidden> Mon, 02 Nov 2015 09:25:30 +0200
-
mariadb-10.0 (10.0.20-0ubuntu0.15.04.1) vivid-security; urgency=low
* SECURITY UPDATE: Update to 10.0.20 (via .18 and .19) fixes security issues:
- CVE-2015-3152: Client command line option --ssl-verify-server-cert (and
MYSQL_OPT_SSL_VERIFY_SERVER_CERT option of the client API) when used
together with --ssl will ensure that the established connection is
SSL-encrypted and the MariaDB server has a valid certificate.
(LP: #1464895)
- CVE-2014-8964: bundled PCRE contained heap-based buffer overflow
vulnerability that allowed the server to crash or have other unspecified
impact via a crafted regular expression made possible with the
REGEXP_SUBSTR function (MDEV-8006).
- CVE-2015-0501
- CVE-2015-2571
- CVE-2015-0505
- CVE-2015-0499
(LP: #1451677)
* New release includes fix for memory corruption on arm64 (LP: #1427406)
* Upstream also includes lots of line ending changes (from CRLF -> LF)
-- Otto Kekäläinen <email address hidden> Fri, 03 Jul 2015 17:39:42 +0300
-
mariadb-10.0 (10.0.17-0ubuntu1) vivid; urgency=medium
* New upstream microrelease.
* Drop patches no longer required:
- d/p/reproducible-builds-fix-connect.patch: upstream no longer uses
__DATE__ and __TIME__ in build.
- new_valid_certs.patch, new_valid_certs_test_fix.patch: tests fixed
upstream with new certificate.
* Refresh remove_rename_mariadb-server_files_in.patch to remove fuzz.
* Cherry-picks from Debian VCS in range e73d494..c0b5f94 as the others
are not suitable for feature freeze:
- [221008e] Adding mysqld_multi_confd.patch, makes mysqld_multi
reading conf.d (Closes: #778761)
- [361e420] Adding mysqld_multi.server_lsb-header.patch, provides
LSB headers for example initscript (Closes: #778762)
- [5038203] d/rules: added same hardening line as in mysql-5.6
packaging after validation with hardening-check tool
- [c0b5f94] Updated Swedish debconf translations
- Fixes to d/mariadb-server-10.0.postinst:
+ [72b30b2] Remove script output, such invasive debugging is no
longer needed.
+ [ffefd9a] Set mysql_rundir
+ [14fd487] Fix postinst script failure: don't use unsupported
DELIMITER in mysqld command (LP: #1429725).
-- Robie Basak <email address hidden> Thu, 16 Apr 2015 14:16:45 +0000
