|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2005-0711: Please update MySQL 4.1.10 to 4.1.10a before releasing SUSE Linux 9.3 | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Lenz Grimmer <lgrimmer> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Major | ||
| Priority: | P5 - None | CC: | aj, meissner, security-team |
| Version: | unspecified | Keywords: | security |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | All | ||
| URL: | http://dev.mysql.com/doc/mysql/en/news-4-1-10.html | ||
| Whiteboard: | CVE-2005-0711: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N) | ||
| Found By: | Third Party Developer/Partner | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Lenz Grimmer
2005-03-09 11:52:12 UTC
Michal, please do the update. Updated. Thanks a lot! Keep up the good work. please port the patch to the older mysqls ... (the create function one is needed, the tmprace one optional) Just to make it clear: By create function you refer to uninitialised create_flags? By tmprace you mean creating tables with O_EXCL|O_NOFOLLOW? the create function fixes ... most of those are in the first bitkeeper URL, all entries with:"--allow_suspicious_udfs" inside. The second bk url is just a bugfix for the first one I think. the latter (table creation) if it is easy to port. "MySQL fails to properly validate input for authenticated users with INSERT and DELETE privileges (CAN-2005-0709 and CAN-2005-0710). Furthermore MySQL uses predictable filenames when creating temporary files with CREATE TEMPORARY TABLE (CAN-2005-0711)." Ludwig: That is yet another issue? That's what gentoo wrote in their advisory. The CAN descriptions sounded like the issues discussed here to me. You can look up the CAN numbers at http://cve.mitre.org/, e.g. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0711 CAN issues looks like this issue, but I have no idea where they found "INSERT and DELETE privileges"... Packages submited. Then let's close this. please do not close security bugs before we finished the update process swamp id 661 is only the "mysql" package affected or subpackages as well? mysql-Max is affected as well. thanks, patchinfo submitted updates and advisory released CVE-2005-0711: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N) |