--------------------------------------------------------------------- Fedora Legacy Test Update Notification FEDORALEGACY-2005-2129 Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=2129 2005-02-21 ---------------------------------------------------------------------
Name : mysql Versions : rh7.3: mysql-3.23.58-1.73.5.legacy Versions : rh9: mysql-3.23.58-1.90.5.legacy Versions : fc1: mysql-3.23.58-4.3.legacy Summary : The MySQL server and related files. Description : MySQL is a true multi-user, multi-threaded SQL database server. MySQL is a client/server implementation that consists of a server daemon (mysqld) and many different client programs and libraries. This package contains the MySQL server and some accompanying files and directories.
--------------------------------------------------------------------- Update Information:
Updated mysql packages that fix various security issues are now available.
MySQL is a multi-user, multi-threaded SQL database server.
This update fixes a number of potential security problems associated with careless handling of temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0381, CAN-2004-0388, CAN-2004-0457, and CAN-2005-0004 to these issues.
Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked the CREATE/INSERT rights of the old table instead of the new one. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0835 to this issue.
Lukasz Wojtow discovered a buffer overrun in the mysql_real_connect function. In order to exploit this issue an attacker would need to force the use of a malicious DNS server (CAN-2004-0836).
Dean Ellis discovered that multiple threads ALTERing the same (or different) MERGE tables to change the UNION could cause the server to crash or stall (CAN-2004-0837).
Sergei Golubchik discovered that if a user is granted privileges to a
database with a name containing an underscore ("_"), the user also gains
the ability to grant privileges to other databases with similar names
(CAN-2004-0957).All users of mysql should upgrade to these updated packages, which resolve these issues.
--------------------------------------------------------------------- Changelogs
rh73:
* Sun Feb 20 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.73.5.legacy
- Added time and libtermcap-devel BuildRequires
* Fri Feb 11 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.73.4.legacy
- Added better security patch for CAN-2004-0457
- Added security patch for CAN-2005-0004
* Wed Oct 13 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.73.3.legacy
- Added security patch for CAN-2004-0835, CAN-2004-0836, CAN-2004-0837
and privilege escalation issue on GRANT ALL ON `Foo\_Bar` (no CVE yet)
* Fri Sep 10 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.73.2.legacy
- Added mysqlhotcopy patch to fix CAN-2004-0457
* Tue Jul 06 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.73.1.legacy
- Added symlink patch to fix CAN-2004-0381 and CAN-2004-0388
rh9:
* Sun Feb 20 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.90.5.legacy
- Added time and libtermcap-devel BuildRequires
* Fri Feb 11 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.90.4.legacy
- Added better security patch for CAN-2004-0457
- Added security patch for CAN-2005-0004
* Wed Oct 13 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.90.3.legacy
- Added security patch for CAN-2004-0835, CAN-2004-0836, CAN-2004-0837
and privilege escalation issue on GRANT ALL ON `Foo\_Bar` (no CVE yet)
* Fri Sep 10 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.90.2.legacy
- Added mysqlhotcopy patch to fix CAN-2004-0457
* Tue Jul 06 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-1.90.1.legacy
- Added symlink patch to fix CAN-2004-0381 and CAN-2004-0388
fc1:
* Sun Feb 20 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-4.3.legacy
- Added time and libtermcap-devel BuildRequires
* Fri Feb 11 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-4.2.legacy
- Added better security patch for CAN-2004-0457
- Added security patch for CAN-2005-0004
* Wed Oct 13 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 3.23.58-4.1.legacy
- Added security patch for CAN-2004-0835, CAN-2004-0836, CAN-2004-0837
and privilege escalation issue on GRANT ALL ON `Foo\_Bar` (no CVE yet)
- Added hotcopy patch to fix CAN-2004-0457
- Added symlink patch to fix CAN-2004-0381 and CAN-2004-0388
--------------------------------------------------------------------- This update can be downloaded from: http://download.fedoralegacy.org/ (sha1sums)
rh7.3:
04ef0f04b389f7f9fc5bb46f35f81e8503a463ba redhat/7.3/updates-testing/i386/mysql-3.23.58-1.73.5.legacy.i386.rpm
879f133178898835609ec305988b473e7221f825 redhat/7.3/updates-testing/i386/mysql-devel-3.23.58-1.73.5.legacy.i386.rpm
9258ee1dd63f878c376a4e8a4f28e6dc8be11600 redhat/7.3/updates-testing/i386/mysql-server-3.23.58-1.73.5.legacy.i386.rpm
f8dfbc8e8992bb56c1f8ba9f6917ab0fb11d0e80 redhat/7.3/updates-testing/SRPMS/mysql-3.23.58-1.73.5.legacy.src.rpm
rh9:
246af76de738268375fee9c066efdabdc5a01f73 redhat/9/updates-testing/i386/mysql-3.23.58-1.90.5.legacy.i386.rpm
22b584c92e81cd29086fa2335910ba5b67d22711 redhat/9/updates-testing/i386/mysql-devel-3.23.58-1.90.5.legacy.i386.rpm
4fe21cae92371b5a3ed79858ec5432807bf2cee4 redhat/9/updates-testing/i386/mysql-server-3.23.58-1.90.5.legacy.i386.rpm
106480fe6f5d56513a4fd77592d5a8e88a9c4825 redhat/9/updates-testing/SRPMS/mysql-3.23.58-1.90.5.legacy.src.rpm
fc1:
509f1caeef89bb626334be27e13c4269cc00ca75 fedora/1/updates-testing/i386/mysql-3.23.58-4.3.legacy.i386.rpm
7e0bf52038d1ccb3e56f8f2e48f32846e9cb52ec fedora/1/updates-testing/i386/mysql-bench-3.23.58-4.3.legacy.i386.rpm
08c25d36193f30dceb4d3f81fbdd69f713fd94b7 fedora/1/updates-testing/i386/mysql-devel-3.23.58-4.3.legacy.i386.rpm
8fa58175f2d1baf7d45e8c19939928d3faa113ba fedora/1/updates-testing/i386/mysql-server-3.23.58-4.3.legacy.i386.rpm
291ec6bb776126c3726dc7dfc067afad520300af fedora/1/updates-testing/SRPMS/mysql-3.23.58-4.3.legacy.src.rpm
---------------------------------------------------------------------
Please test and comment in bugzilla.
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-legacy-list@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-legacy-list
