Date: Wed, 05 Aug 2026 13:40:39 +0000 From: Jochen Neumeister <joneum@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 7f4a5b97c0d6 - main - security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026 Message-ID: <6a733d57.3bc70.39d6d25d@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by joneum: URL: https://cgit.FreeBSD.org/ports/commit/?id=7f4a5b97c0d65c00c22c8faf2cd89e47f38ecae4 commit 7f4a5b97c0d65c00c22c8faf2cd89e47f38ecae4 Author: Jochen Neumeister <joneum@FreeBSD.org> AuthorDate: 2026-08-05 13:37:00 +0000 Commit: Jochen Neumeister <joneum@FreeBSD.org> CommitDate: 2026-08-05 13:40:30 +0000 security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026 The Oracle Critical Patch Update of July 2026 fixes 54 issues in Oracle MySQL. 31 of them affect the 8.4 series, 43 the 9.7 series, including the MySQL Router shipped with the server ports. Three issues require no credentials: one in the X Plugin and two in MySQL Router, the latter of which allows unauthorized read and write access. The remaining ones mostly need a privileged account and lead to a denial of service. Fixed in 8.4.11 and 9.7.2 respectively. Sponsored by: Netzkommune GmbH --- security/vuxml/vuln/2026.xml | 168 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 168 insertions(+) diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml index cbe34e1292b9..5c9a7117bf59 100644 --- a/security/vuxml/vuln/2026.xml +++ b/security/vuxml/vuln/2026.xml @@ -1,3 +1,171 @@ + <vuln vid="10f5d195-90a5-11f1-bc30-3497f65b111b"> + <topic>MySQL 8.4 -- Multiple vulnerabilities</topic> + <affects> + <package> + <name>mysql84-client</name> + <range><lt>8.4.11</lt></range> + </package> + <package> + <name>mysql84-server</name> + <range><lt>8.4.11</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Oracle Critical Patch Update of July 2026 addresses 54 issues + in Oracle MySQL, 31 of which apply to the MySQL 8.4 series and to + the MySQL Router shipped with these ports.</p> + <p>The affected server components are Optimizer, Replication, + Group Replication (plugin and GCS), X Plugin, Clone Plugin, + InnoDB, JSON, DDL, Performance Schema and Pluggable + Authentication.</p> + <p>Most of the issues require an authenticated account, in many + cases one with high privileges, and let an attacker hang or + repeatedly crash the server, resulting in a denial of service. + Three issues need no credentials at all: CVE-2026-60315 (CVSS + 8.2) is reachable over the X protocol and affects availability, + while CVE-2026-60314 and CVE-2026-60725 affect MySQL Router over + HTTP, the latter allowing unauthorized read and write access. + The highest rated issue for this branch is CVE-2026-60163 (CVSS + 8.4) in the Group Replication plugin, exploitable locally with + full impact on confidentiality, integrity and availability.</p> + <p>Please refer to the referenced CVE entries for the details of + each individual issue.</p> + </body> + </description> + <references> + <cvename>CVE-2026-46936</cvename> + <cvename>CVE-2026-47012</cvename> + <cvename>CVE-2026-47023</cvename> + <cvename>CVE-2026-47052</cvename> + <cvename>CVE-2026-47064</cvename> + <cvename>CVE-2026-60145</cvename> + <cvename>CVE-2026-60163</cvename> + <cvename>CVE-2026-60177</cvename> + <cvename>CVE-2026-60178</cvename> + <cvename>CVE-2026-60182</cvename> + <cvename>CVE-2026-60183</cvename> + <cvename>CVE-2026-60184</cvename> + <cvename>CVE-2026-60185</cvename> + <cvename>CVE-2026-60186</cvename> + <cvename>CVE-2026-60187</cvename> + <cvename>CVE-2026-60188</cvename> + <cvename>CVE-2026-60189</cvename> + <cvename>CVE-2026-60190</cvename> + <cvename>CVE-2026-60191</cvename> + <cvename>CVE-2026-60314</cvename> + <cvename>CVE-2026-60315</cvename> + <cvename>CVE-2026-60316</cvename> + <cvename>CVE-2026-60331</cvename> + <cvename>CVE-2026-60332</cvename> + <cvename>CVE-2026-60585</cvename> + <cvename>CVE-2026-60725</cvename> + <cvename>CVE-2026-60747</cvename> + <cvename>CVE-2026-61081</cvename> + <cvename>CVE-2026-61094</cvename> + <cvename>CVE-2026-61096</cvename> + <cvename>CVE-2026-61109</cvename> + <url>https://www.oracle.com/security-alerts/cpujul2026.html</url>; + <url>https://dev.mysql.com/community/security/advisories/2026-07-21/</url>; + </references> + <dates> + <discovery>2026-07-21</discovery> + <entry>2026-08-05</entry> + </dates> + </vuln> + + <vuln vid="10f5f76e-90a5-11f1-bc30-3497f65b111b"> + <topic>MySQL 9.7 -- Multiple vulnerabilities</topic> + <affects> + <package> + <name>mysql97-client</name> + <range><lt>9.7.2</lt></range> + </package> + <package> + <name>mysql97-server</name> + <range><lt>9.7.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Oracle Critical Patch Update of July 2026 addresses 54 issues + in Oracle MySQL, 43 of which apply to the MySQL 9.7 series and to + the MySQL Router shipped with these ports. The 9.7 branch is + affected by every server issue of the 8.4 branch plus twelve + additional ones in code paths that only exist in 9.x.</p> + <p>The affected server components are Optimizer, Replication, + Group Replication (plugin and GCS), X Plugin, Clone Plugin, + InnoDB, JSON, JSON Duality, GIS, DDL, Configurator, Performance + Schema and Pluggable Authentication.</p> + <p>Most of the issues require an authenticated account, in many + cases one with high privileges, and let an attacker hang or + repeatedly crash the server, resulting in a denial of service. + Three issues need no credentials at all: CVE-2026-60315 (CVSS + 8.2) is reachable over the X protocol and affects availability, + while CVE-2026-60314 and CVE-2026-60725 affect MySQL Router over + HTTP, the latter allowing unauthorized read and write access. + The highest rated issue for this branch is CVE-2026-60163 (CVSS + 8.4) in the Group Replication plugin, exploitable locally with + full impact on confidentiality, integrity and availability. + CVE-2026-60181 in the Configurator component requires user + interaction and is specific to the 9.7 branch.</p> + <p>Please refer to the referenced CVE entries for the details of + each individual issue.</p> + </body> + </description> + <references> + <cvename>CVE-2026-46936</cvename> + <cvename>CVE-2026-47008</cvename> + <cvename>CVE-2026-47012</cvename> + <cvename>CVE-2026-47023</cvename> + <cvename>CVE-2026-47052</cvename> + <cvename>CVE-2026-47064</cvename> + <cvename>CVE-2026-60145</cvename> + <cvename>CVE-2026-60163</cvename> + <cvename>CVE-2026-60174</cvename> + <cvename>CVE-2026-60177</cvename> + <cvename>CVE-2026-60178</cvename> + <cvename>CVE-2026-60181</cvename> + <cvename>CVE-2026-60182</cvename> + <cvename>CVE-2026-60183</cvename> + <cvename>CVE-2026-60184</cvename> + <cvename>CVE-2026-60185</cvename> + <cvename>CVE-2026-60186</cvename> + <cvename>CVE-2026-60187</cvename> + <cvename>CVE-2026-60188</cvename> + <cvename>CVE-2026-60189</cvename> + <cvename>CVE-2026-60190</cvename> + <cvename>CVE-2026-60191</cvename> + <cvename>CVE-2026-60194</cvename> + <cvename>CVE-2026-60195</cvename> + <cvename>CVE-2026-60311</cvename> + <cvename>CVE-2026-60314</cvename> + <cvename>CVE-2026-60315</cvename> + <cvename>CVE-2026-60316</cvename> + <cvename>CVE-2026-60324</cvename> + <cvename>CVE-2026-60331</cvename> + <cvename>CVE-2026-60332</cvename> + <cvename>CVE-2026-60585</cvename> + <cvename>CVE-2026-60718</cvename> + <cvename>CVE-2026-60725</cvename> + <cvename>CVE-2026-60747</cvename> + <cvename>CVE-2026-61081</cvename> + <cvename>CVE-2026-61093</cvename> + <cvename>CVE-2026-61094</cvename> + <cvename>CVE-2026-61096</cvename> + <cvename>CVE-2026-61108</cvename> + <cvename>CVE-2026-61109</cvename> + <cvename>CVE-2026-61128</cvename> + <cvename>CVE-2026-61144</cvename> + <url>https://www.oracle.com/security-alerts/cpujul2026.html</url>; + <url>https://dev.mysql.com/community/security/advisories/2026-07-21/</url>; + </references> + <dates> + <discovery>2026-07-21</discovery> + <entry>2026-08-05</entry> + </dates> + </vuln> + <vuln vid="575ddefc-9085-11f1-b295-98b78501ef2a"> <topic>PowerDNS Recursor -- multiple vulnerabilities</topic> <affects>home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a733d57.3bc70.39d6d25d>