CVE-2021-46667 Integer overflow in n/a

Medium 5.5 Published 1 Feb 2022 Updated 4 Aug 2024

An integer overflow in MariaDB's SQL lexer allows attackers to cause a denial of service via application crash.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-46667?

CVE-2021-46667 is a medium-severity vulnerability in Fedoraproject Fedora, published on 1 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

Weakness: CWE-190

Which versions are affected by CVE-2021-46667?

3 open source packages ship an affected version, including mariadb, mariadb-min and mysql-client. It affects 2 products.

Package	Affected	Fixed in
`mariadb` Bitnami	All versions	`10.2.41, 10.3.32, 10.4.22, 10.5.13, 10.6.5`
`mariadb-min` Bitnami	All versions	`10.2.41, 10.3.32, 10.4.22, 10.5.13, 10.6.5`
`mysql-client` Bitnami	All versions	`10.2.41, 10.3.32, 10.4.22, 10.5.13, 10.6.5`

Products include Fedoraproject Fedora, Mariadb Mariadb.

How do I fix CVE-2021-46667?

Upgrade mariadb to a fixed version for your release line: 10.2.41, 10.3.32, 10.4.22 or 10.5.13.

Is CVE-2021-46667 being exploited?

There is no known exploitation of CVE-2021-46667 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALPINE-CVE-2021-46667, AZL-8411, BIT-mariadb-2021-46667, BIT-mariadb-min-2021-46667, BIT-mysql-client-2021-46667, DEBIAN-CVE-2021-46667 and 2 more.