mariadb: multiple issues

• CVE-2016-6662 (arbitrary code execution)

Researcher Dawid Golunski discovered several security issues in the
mariadb DBMS, including a vulnerability flaw that can be exploited by a
remote attacker to inject malicious settings into my.cnf configuration
files. The flaw can be triggered to fully compromise the DBMS by
executing arbitrary code with root privileges if mysqld_safe is
executed.

• CVE-2016-6663 (access restriction bypass)

In the past mariadb used to read the main configuration file from three
different locations. One of them (the datadir) is unsafe because it’s
writeable by the sql-server. This way a remote attacker who could gain
access to the sql-server could deploy a maliciously crafted
configuration file.