Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

An out-of-bounds read vulnerability was found in MariaDB's ST_Area function. An authenticated, low-privileged SQL user can trigger the flaw by supplying a crafted MULTIPOLYGON geometry, which allows reading beyond allocated heap memory. This can reportedly disclose heap contents and executable base addresses, enabling ASLR bypass. When chained with a separate use-after-free vulnerability, this information disclosure can facilitate privilege escalation to operating-system command execution.

The researcher reports successful exploitation against MariaDB 13.0.1-rc with ASLR, PIE, and Full RELRO enabled.

Reference: https://hackerone.com/reports/3856148