OESA-2026-4595

    Dashboard / Vulnerabilities / OESA-2026-4595

    OESA-2026-4595

    Published: 29 Oct 2026Last Modified: 29 Oct 2026
    Upstream:
    CVE-2026-107814

    Summary: mariadb security update

    Details: MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.(CVE-2026-107814)

    References: https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4595, https://nvd.nist.gov/vuln/detail/CVE-2026-107814

    Affected packages

    Package

    Name: mariadb

    Purl: pkg:rpm/openEuler/mariadb&distro=openEuler-24.03-LTS-SP4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -10.11.19-2.oe2403sp4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2026-4595 | CVE-DB