Tuxcare Errata System 0.0.1 5.10 2026-10-15T20:01:28 Ubuntu 22.04 LTS * SECURITY UPDATE: unauthenticated XCom client_msg injection in Group Replication - debian/patches/CVE-2026-60163.patch: reject application, transaction, view and other cargo types received on an external XCom client connection in acceptor_learner_task(), xcom_base.cc (upstream BUG#39234600). - CVE-2026-60163 * SECURITY UPDATE: applier privilege-check bypass via client BINLOG - debian/patches/CVE-2026-61094.patch: decide whether the applier privilege checks apply from whether the Relay_log_info belongs to a client, not from the BINLOG payload length (>= 2048 bytes skipped them), in Applier_security_context_guard, sql/rpl_rli.cc (upstream Bug#39474825). - CVE-2026-61094 Important TuxCare License Agreement CVE-2026-60163 CVE-2026-61094 Ubuntu 22.04 LTS * SECURITY UPDATE: X Plugin accepts malformed challenge-response payloads - debian/patches/CVE-2026-60315.patch: require the client scramble and stored hash to have the expected length and format before get_salt_from_password() parses them, in plugin/x/src/native_verification.cc and plugin/x/src/cache_based_verification.cc. - CVE-2026-60315 * SECURITY UPDATE: server hang on a cyclic JSON schema reference - debian/patches/CVE-2026-61109.patch: reject cyclic $ref chains when validating a JSON schema, in sql/json_schema.cc. - CVE-2026-61109 * SECURITY UPDATE: use-after-free of TABLE::read_set in DynamicRangeIterator - debian/patches/CVE-2026-47064.patch: restore the saved read_set through a Scope_guard on every exit path of IndexSkipScanIterator::Init() and Read(), in sql/range_optimizer/index_skip_scan.cc. - CVE-2026-47064 * SECURITY UPDATE: optimizer crash (SEGV) in subquery_to_derived - debian/patches/CVE-2026-60145.patch: reference-count the Item_field copy made in Query_block::replace_item_in_expression(), so it cannot be freed while another occurrence still refers to it, in sql/sql_resolver.cc. - CVE-2026-60145 * SECURITY UPDATE: null pointer dereference in the clone apply path - debian/patches/CVE-2026-60177.patch: validate the data file index before dereferencing it, in storage/innobase/clone/clone0apply.cc. - CVE-2026-60177 * SECURITY UPDATE: failed DDL leaves index builders uncleaned - debian/patches/CVE-2026-46936.patch: release all builders when a DDL operation fails, in storage/innobase/ddl/ddl0builder.cc. - CVE-2026-46936 * SECURITY UPDATE: clone client can be directed to write to an arbitrary path - debian/patches/CVE-2026-60178.patch: validate the donor-supplied file path before the clone client writes it, in storage/innobase/clone/clone0apply.cc. - CVE-2026-60178 * SECURITY UPDATE: clone client crash from an unchecked descriptor index - debian/patches/CVE-2026-60182.patch: bound-check loc_index in Client::set_descriptor() before use, in plugin/clone/src/clone_client.cc. - CVE-2026-60182 * SECURITY UPDATE: performance schema exposes raw object instance addresses - debian/patches/CVE-2026-61081.patch: derive OBJECT_INSTANCE_BEGIN columns instead of exposing raw pointers, in storage/perfschema/. - CVE-2026-61081 * SECURITY UPDATE: InnoDB deadlock from a missed FIL_SHARD release - debian/patches/CVE-2026-47052.patch: release the fil shard on the error path so concurrent tablespace lookups cannot deadlock under load, in storage/innobase/fil/fil0fil.cc. - CVE-2026-47052 * SECURITY UPDATE: donor-controlled dlopen() path traversal during clone plugin validation - debian/patches/CVE-2026-60183.patch: validate donor-supplied shared object names before dlopen(), in plugin/clone/src/clone_client.cc. - CVE-2026-60183 * SECURITY UPDATE: X Plugin SQL injection with NO_BACKSLASH_ESCAPES - debian/patches/CVE-2026-60316.patch: escape string literals according to the session's NO_BACKSLASH_ESCAPES mode when building SQL in the X Plugin, via the new plugin/x/src/helper/sql_literal_escaping.h and query_formatter.cc. - CVE-2026-60316 * SECURITY UPDATE: server crash from a failed CHECK TABLE on a lost connection - debian/patches/CVE-2026-47012.patch: handle the network error path during CHECK TABLE without dereferencing the released table, in sql/sql_admin.cc. - CVE-2026-47012 Important TuxCare License Agreement CVE-2026-60189 CVE-2026-61081 CVE-2026-47023 CVE-2026-60585 CVE-2026-60190 CVE-2026-60183 CVE-2026-60186 CVE-2026-60184 CVE-2026-60182 CVE-2026-60315 CVE-2026-47052 CVE-2026-60316 CVE-2026-60188 CVE-2026-60191 CVE-2026-60331 CVE-2026-60185 CVE-2026-46936 CVE-2026-47064 CVE-2026-60178 CVE-2026-60177 CVE-2026-60332 CVE-2026-61109 CVE-2026-60145 CVE-2026-47012 CVE-2026-60187 CVE-2026-60747 libperconaserverclient21 libperconaserverclient21-dev percona-mysql-router percona-server-client percona-server-common percona-server-rocksdb percona-server-server percona-server-source percona-server-test amd64 0:8.0.46-37-1.jammy+tuxcare.els2 amd64 0:8.0.46-37-1.jammy+tuxcare.els4