This upload (I started checking resolute) is full of security fixes:
mariadb (1:11.8.9+ds-0ubuntu0.26.04.1) resolute; urgency=medium
[ Otto Kekäläinen ]
* SECURITY UPDATE: New upstream maintenance release 11.8.9 (LP: #2168592)
includes several fixes as listed at
https://mariadb.com/docs/release-notes/community-server/11.8/11.8.9
and fixes the following CVE tracked security issues, as listed at
https://mariadb.com/docs/server/security/cve/community-server
- Fixed in upstream 11.8.9 (2026-08-24):
- CVE-2026-61081
- CVE-2026-60585
- CVE-2026-60331
- CVE-2026-60747
- CVE-2026-47023
- CVE-2026-60184
- Fixed in upstream 11.8.8 (2026-05-27):
- CVE-2026-49261
- CVE-2026-48165
- CVE-2026-48163
- Fixed in upstream 11.8.7 (2026-05-18):
- CVE-2026-47064
- CVE-2026-44173
- CVE-2026-44172
- CVE-2026-44171
- CVE-2026-44170
- CVE-2026-44169
- CVE-2026-44168
- Fixed in upstream 11.8.6 (2026-02-04):
- CVE-2026-3494
- CVE-2026-32710
- CVE-2026-35549
- CVE-2026-34303
- Fixed in upstream 11.8.4 (2025-11-06):
- CVE-2026-21968
- CVE-2025-13699
* The vendor CVE list above lists CVE-2026-61081 twice, with different CVSS
base scores and publication dates but the same set of fixed releases. It is
listed only once here
* CVE-2026-44168, CVE-2026-44169, CVE-2026-44171, CVE-2026-44172,
CVE-2026-44173, CVE-2026-48163, CVE-2026-48165 and CVE-2026-49261 were
already patched in 1:11.8.6-5ubuntu0.1, and CVE-2025-13699 was documented
in 1:11.8.5-1. CVE-2026-21968 was fixed in upstream 11.8.4, which was
skipped in Debian, and 1:11.8.5-1 documented no CVE fixes, so exactly when
that fix entered the archive is not recorded in this changelog
* CVE-2026-47064, CVE-2026-44170, CVE-2026-3494, CVE-2026-32710,
CVE-2026-35549 and CVE-2026-34303 had not been patched in any earlier
revision of this package, so this is the first Debian and Ubuntu release
to include fixes for them. These security issues were not known when
1:11.8.6-1 was released, hence the note there about the release not
including any CVE tracked security fixes.
@security team, how do you want to handle this?
a) build in security ppa, then binary copy to proposed
b) build in normal proposed, release, then you grab it, rebuild in security,
bump version, release again
c) you were already preparing USNs for these, and this SRU would overwrite them
** CVE added: https://cve.org/CVERecord?id=CVE-2025-13699
** CVE added: https://cve.org/CVERecord?id=CVE-2026-21968
** CVE added: https://cve.org/CVERecord?id=CVE-2026-32710
** CVE added: https://cve.org/CVERecord?id=CVE-2026-34303
** CVE added: https://cve.org/CVERecord?id=CVE-2026-3494
** CVE added: https://cve.org/CVERecord?id=CVE-2026-35549
** CVE added: https://cve.org/CVERecord?id=CVE-2026-44168
** CVE added: https://cve.org/CVERecord?id=CVE-2026-44169
** CVE added: https://cve.org/CVERecord?id=CVE-2026-44170
** CVE added: https://cve.org/CVERecord?id=CVE-2026-44171
** CVE added: https://cve.org/CVERecord?id=CVE-2026-44172
** CVE added: https://cve.org/CVERecord?id=CVE-2026-44173
** CVE added: https://cve.org/CVERecord?id=CVE-2026-47023
** CVE added: https://cve.org/CVERecord?id=CVE-2026-47064
** CVE added: https://cve.org/CVERecord?id=CVE-2026-48163
** CVE added: https://cve.org/CVERecord?id=CVE-2026-48165
** CVE added: https://cve.org/CVERecord?id=CVE-2026-49261
** CVE added: https://cve.org/CVERecord?id=CVE-2026-60184
** CVE added: https://cve.org/CVERecord?id=CVE-2026-60331
** CVE added: https://cve.org/CVERecord?id=CVE-2026-60585
** CVE added: https://cve.org/CVERecord?id=CVE-2026-60747
** CVE added: https://cve.org/CVERecord?id=CVE-2026-61081
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168592
Title:
[SRU] MariaDB 11.8.9, 10.11.19, 10.6.28 in all maintained Ubuntu
releases
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mariadb/+bug/2168592/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
