Security update for mariadb SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:20175-1 Final 1 1 2025-12-22T11:44:04Z current 2025-12-22T11:44:04Z 2025-12-22T11:44:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mariadb This update for mariadb fixes the following issues: - Update to 11.8.5: * CVE-2025-13699: Fixed Directory Traversal Remote Code Execution Vulnerability (bsc#1254313) Other fixes: - Add %license tags to license files (bsc#1252162) - Add INSTALL_DOCREADMEDIR cmake flag to install readme and license files - Remove client plugin parsec.so, it is shipped by libmariadb_plugins (bsc#1243040, bsc#1254476) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Leap-16.0-116 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1243040 SUSE Bug 1243040 https://bugzilla.suse.com/1252162 SUSE Bug 1252162 https://bugzilla.suse.com/1254313 SUSE Bug 1254313 https://bugzilla.suse.com/1254476 SUSE Bug 1254476 https://www.suse.com/security/cve/CVE-2025-13699/ SUSE CVE CVE-2025-13699 page openSUSE Leap 16.0 libmariadbd-devel-11.8.5-160000.1.1 libmariadbd19-11.8.5-160000.1.1 mariadb-11.8.5-160000.1.1 mariadb-bench-11.8.5-160000.1.1 mariadb-client-11.8.5-160000.1.1 mariadb-errormessages-11.8.5-160000.1.1 mariadb-galera-11.8.5-160000.1.1 mariadb-rpm-macros-11.8.5-160000.1.1 mariadb-test-11.8.5-160000.1.1 mariadb-tools-11.8.5-160000.1.1 libmariadbd-devel-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 libmariadbd19-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 mariadb-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 mariadb-bench-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 mariadb-client-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 mariadb-errormessages-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 mariadb-galera-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 mariadb-rpm-macros-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 mariadb-test-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 mariadb-tools-11.8.5-160000.1.1 as a component of openSUSE Leap 16.0 MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000. CVE-2025-13699 openSUSE Leap 16.0:libmariadbd-devel-11.8.5-160000.1.1 openSUSE Leap 16.0:libmariadbd19-11.8.5-160000.1.1 openSUSE Leap 16.0:mariadb-11.8.5-160000.1.1 openSUSE Leap 16.0:mariadb-bench-11.8.5-160000.1.1 openSUSE Leap 16.0:mariadb-client-11.8.5-160000.1.1 openSUSE Leap 16.0:mariadb-errormessages-11.8.5-160000.1.1 openSUSE Leap 16.0:mariadb-galera-11.8.5-160000.1.1 openSUSE Leap 16.0:mariadb-rpm-macros-11.8.5-160000.1.1 openSUSE Leap 16.0:mariadb-test-11.8.5-160000.1.1 openSUSE Leap 16.0:mariadb-tools-11.8.5-160000.1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-13699.html CVE-2025-13699 https://bugzilla.suse.com/1254313 SUSE Bug 1254313