CVE-2021-46669: Use After Free

Q: What is CVE-2021-46669?

CVE-2021-46669 is a vulnerability in MariaDB through version 10.5.9 that allows attackers to trigger a use-after-free when the BIGINT data type is used.

Q: How severe is CVE-2021-46669?

CVE-2021-46669 has a severity score of 7.5 out of 10.

Q: Which software versions are affected by CVE-2021-46669?

CVE-2021-46669 affects MariaDB versions 10.2.44 to 10.5.9.

Q: How can I fix CVE-2021-46669?

To fix CVE-2021-46669, update MariaDB to version 10.5.10 or later.

Q: Where can I find more information about CVE-2021-46669?

More information about CVE-2021-46669 can be found in the following references: [Link 1](https://jira.mariadb.org/browse/MDEV-25638), [Link 2](https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html), [Link 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRJCSPQHYPKTWXXZVDMY6JAHZJQ4TZ5X/).

Published Feb 1, 2022

Updated

Last updated 24 July 2024

Other sources

MariaDB through 10.5.9 allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used.

— Launchpad

Affected Software

16 affected componentsFixes available

redhat/mariadb<10.2.44

10.2.44

redhat/mariadb<10.3.35

10.3.35

redhat/mariadb<10.4.25

10.4.25

redhat/mariadb<10.5.16

10.5.16

redhat/mariadb<10.6.8

10.6.8

redhat/mariadb<10.7.4

10.7.4

MariaDB MariaDB<10.2.44

MariaDB MariaDB>=10.3.0<10.3.35

MariaDB MariaDB>=10.4.0<10.4.25

MariaDB MariaDB>=10.5.0<10.5.16

MariaDB MariaDB>=10.6.0<10.6.8

MariaDB MariaDB>=10.7.0<10.7.4

Fedoraproject Fedora=35

Fedoraproject Fedora=36

Debian Debian Linux=10.0

debian/mariadb-10.5

1:10.5.23-0+deb11u11:10.5.28-0+deb11u1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.2.44
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.3.35
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.4.25
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.5.16
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.6.8
Upgrade
Upgrade redhat/mariadb to a version that resolves this vulnerability.
Fixed in 10.7.4
Upgrade
Upgrade debian/mariadb-10.5 to a version that resolves this vulnerability.
Fixed in 1:10.5.23-0+deb11u1Fixed in 1:10.5.28-0+deb11u1

Event History

Feb 1, 2022

CVE Published

via MITRE·01:46 AM

Data Sourced

via MITRE·01:46 AM

Description

Frequently Asked Questions

What is CVE-2021-46669?

CVE-2021-46669 is a vulnerability in MariaDB through version 10.5.9 that allows attackers to trigger a use-after-free when the BIGINT data type is used.

How severe is CVE-2021-46669?