-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2581-1 security@xxxxxxxxxx http://www.debian.org/security/ Yves-Alexis Perez December 04, 2012 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : mysql-5.1 Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2012-3150 CVE-2012-3158 CVE-2012-3160 CVE-2012-3163 CVE-2012-3166 CVE-2012-3167 CVE-2012-3173 CVE-2012-3177 CVE-2012-3180 CVE-2012-3197 CVE-2012-5611 Debian Bug : 690778 695001 Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.1.66, which includes additional changes, such as performance improvements and corrections for data loss defects. These changes are described in the MySQL release notes at: http://dev.mysql.com/doc/refman/5.1/en/news-5-1-66.html For the testing distribution (wheezy) and unstable distribution (sid), these problems have been fixed in version 5.5.28+dfsg-1. Additionally, CVE-2012-5611 has been fixed in this upload. The vulnerability (discovered independently by Tomas Hoger from the Red Hat Security Response Team and "king cope") is a stack-based buffer overflow in acl_get() when checking user access to a database. Using a carefully crafted database name, an already authenticated MySQL user could make the server crash or even execute arbitrary code as the mysql system user. For the stable distribution (squeeze), this problem has been fixed in version 5.1.66-0+squeeze1. For the testing distribution (wheezy) and unstable distribution (sid), this problem will be fixed soon. We recommend that you upgrade your mysql-5.1 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iQEcBAEBCgAGBQJQvZ/WAAoJEG3bU/KmdcClarEIAJ9nKbUELxjb1eksmEGOXkYr x2WM+6XPVAN+4JKwwFyXCNYJbTPG5J3EM090YguqfnoWvVHZaPbcciymDOyNwPh3 x9Dm7lBNla2/fPvgEsA8enGaQdIrHnOy13Lj4e4Mu/3g1nSBp0eGZIVT6TVy9BJO Hiqds0BZDqHuG/SGtWNsMLs6dMH4iYVcvcK3NFyFh6zt8O73Cbe0xIYDDuwO0uwj HoUk6WxK2qs7auir+XkAShdQAj7KjL7Zs3LmLPaH1oUKvRD/IYJw14NRkdeU8CC5 Jz9sdTICSYxYe11zITXYdF4UYRLpF7W8jW6WDPM5kkZWPTjtUkUB0jcdeFQP6v4= =D3mt -----END PGP SIGNATURE-----
