Bugzilla – Bug 771996
VUL-0: mysql: patch update July 2012
Last modified: 2014-03-04 15:56:39 UTC
+++ This bug was initially created as a clone of Bug #771994 +++ This is meant as a tracker bug. Please split off bugs for particular products (e.g. java, mysql) if necessary. Reference: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
The following CVE's are mentioned for mysql in the Oracle advisory: CVE-2012-1735, CVE-2012-0540, CVE-2012-1757, CVE-2012-1756, CVE-2012-1734, CVE-2012-1689 We need to verify whether these affect us.
bugbot adjusting priority
Oracle MySQL Risk Matrix CVE# Component Protocol Sub- component Remote Exploit without Auth.? CVSS VERSION 2.0 RISK (see Risk Matrix Definitions) Supported Versions Affected Notes Base Score Access Vector Access Complexity Authen- tication Confiden- tiality Integrity Avail- ability CVE-2012-1735 MySQL Server MySQL Protocol Server Optimizer No 6.8 Network Low Single None None Complete 5.5.23 and earlier CVE-2012-0540 MySQL Server MySQL Protocol GIS Extension No 4.0 Network Low Single None None Partial+ 5.1.62 and earlier, 5.5.23 and earlier CVE-2012-1757 MySQL Server MySQL Protocol InnoDB No 4.0 Network Low Single None None Partial+ 5.5.23 and earlier CVE-2012-1756 MySQL Server MySQL Protocol Server No 4.0 Network Low Single None None Partial+ 5.5.23 and earlier CVE-2012-1734 MySQL Server MySQL Protocol Server Optimizer No 4.0 Network Low Single None None Partial+ 5.1.62 and earlier, 5.5.23 and earlier CVE-2012-1689 MySQL Server MySQL Protocol Server Optimizer No 4.0 Network Low Single None None Partial+ 5.1.62 and earlier, 5.5.22 and earlier
remote denial of service post-authentication, highest CVSS Score is 6.8.
No mysql 5.0.x issue is listed. This means SLE is not affected, only openSUSE might be affected.
CVSS Scorting for the issue(s): $VAR1 = \{ 'CVE-2012-1757' => '4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P', 'CVE-2012-1689' => '4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P', 'CVE-2012-0540' => '4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P', 'CVE-2012-1734' => '4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P', 'CVE-2012-1735' => '4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P', 'CVE-2012-1756' => '4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P' };
We will not release mysql updates for older products anymore, and SLES 11 SP3 has mysql 5.5 which i assume is fixed.