Linux · Security advisory · December 12, 2025

ELSA-2025-23137: Security update for 12 packages

ELSA-2025-23137, released December 12, 2025, fixes 8 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: Routine.

Routine

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0058

48th percentile

Priority of the 8 CVEs

Patch now 0
                                Urgent 0
                                High 0
                                Routine 8

Fixed package versions

Product	Release	Fixed in
mecab	ol 8	0:0.996-2.module+el8.10.0+90700+dfc34c39
mecab-devel	ol 8	0:0.996-2.module+el8.10.0+90700+dfc34c39
mecab-ipadic	ol 8	0:2.7.0.20070801-17.0.1.module+el8.10.0+90700+dfc34c39
mecab-ipadic-EUCJP	ol 8	0:2.7.0.20070801-17.0.1.module+el8.10.0+90700+dfc34c39
mysql	ol 8	0:8.4.7-1.module+el8.10.0+90724+e63c91fc
mysql-common	ol 8	0:8.4.7-1.module+el8.10.0+90724+e63c91fc
mysql-devel	ol 8	0:8.4.7-1.module+el8.10.0+90724+e63c91fc
mysql-errmsg	ol 8	0:8.4.7-1.module+el8.10.0+90724+e63c91fc
mysql-libs	ol 8	0:8.4.7-1.module+el8.10.0+90724+e63c91fc
mysql-server	ol 8	0:8.4.7-1.module+el8.10.0+90724+e63c91fc
mysql-test	ol 8	0:8.4.7-1.module+el8.10.0+90724+e63c91fc
mysql-test-data	ol 8	0:8.4.7-1.module+el8.10.0+90724+e63c91fc

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Routine	CVE-2025-53040	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	5.5	0.0058	None reported
Routine	CVE-2025-53042	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	5.5	0.0058	None reported
Routine	CVE-2025-53044	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	5.5	0.0058	None reported
Routine	CVE-2025-53045	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	5.5	0.0058	None reported
Routine	CVE-2025-53062	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	5.5	0.0058	None reported
Routine	CVE-2025-53069	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).	5.5	0.0058	None reported
Routine	CVE-2025-53053	Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).	5.5	0.0048	None reported
Routine	CVE-2025-53054	Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).	5.5	0.0048	None reported

Also fixes CVE-2025-53069

libmysqlclient21 8.0.45-0ubuntu0.20.04.1+esm2
libmysqlclient21 on Ubuntu 20.04 LTS (focal)
mysql-client 8.0.45-0ubuntu0.20.04.1+esm2
mysql-client on Ubuntu 20.04 LTS (focal)
mysql-client-8.0 8.0.45-0ubuntu0.20.04.1+esm2
mysql-client-8.0 on Ubuntu 20.04 LTS (focal)
mysql-client-core-8.0 8.0.45-0ubuntu0.20.04.1+esm2
mysql-client-core-8.0 on Ubuntu 20.04 LTS (focal)
mysql-router 8.0.45-0ubuntu0.20.04.1+esm2
mysql-router on Ubuntu 20.04 LTS (focal)
mysql-server 8.0.45-0ubuntu0.20.04.1+esm2
mysql-server on Ubuntu 20.04 LTS (focal)
mysql-server-8.0 8.0.45-0ubuntu0.20.04.1+esm2
mysql-server-8.0 on Ubuntu 20.04 LTS (focal)
mysql-server-core-8.0 8.0.45-0ubuntu0.20.04.1+esm2
mysql-server-core-8.0 on Ubuntu 20.04 LTS (focal)

Vendor advisory

https://linux.oracle.com/errata/ELSA-2025-23137.html

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo