mariadb-10.1.21 (CVE-2016-6664 CVE-2017-3238 CVE-2017-3243 CVE-2017-3244 CVE-2017-3257 CVE-2017-3258 CVE-2017-3265 CVE-2017-3291 CVE-2017-3312 CVE-2017-3317 CVE-2017-3318)

[bdubbs@…]

New point version

    Innodb updated to 5.6.35
        A file format compatibility bug that was introduced in MariaDB 10.1.0 was fixed. Using page_compression or non-default innodb_page_size created files that were incompatible with MariaDB 10.0 or MySQL 5.6. MariaDB 10.1.21 will convert affected files from earlier MariaDB 10.1 releases to compatible format. This prevents a downgrade to earlier MariaDB 10.1 versions. See the commit for details. 
    Performance Schema updated to 5.6.35 

    Fixes for the following security vulnerabilities:
        CVE-2016-6664
        CVE-2017-3238
        CVE-2017-3243
        CVE-2017-3244
        CVE-2017-3257
        CVE-2017-3258
        CVE-2017-3265
        CVE-2017-3291
        CVE-2017-3312
        CVE-2017-3317
        CVE-2017-3318 

CVE-2016-6664 is a root privilege escalation issue that is classifed as a zero day. There is a video here of it being exploited:

​https://legalhackers.com/videos/MySQL-MariaDB-PerconaDB-PrivEsc-Race-CVE-2016-6663-5616-6664-5617-Exploits.html

​http://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html

Requires immediate response. I'm going to take this and do it in the next few hours.

[Douglas R. Reno]

Fixed at r18201