Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Enterprise Watch List (http://www.linux-archive.org/enterprise-watch-list/)
-   -   Moderate: mysql security update (http://www.linux-archive.org/enterprise-watch-list/327142-moderate-mysql-security-update.html)

02-16-2010 04:07 PM
Moderate: mysql security update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: mysql security update
Advisory ID: RHSA-2010:0109-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0109.html
Issue date: 2010-02-16
CVE Names: CVE-2009-4019 CVE-2009-4028 CVE-2009-4030
================================================== ===================

1. Summary:

Updated mysql packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

3. Description:

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

It was discovered that the MySQL client ignored certain SSL certificate
verification errors when connecting to servers. A man-in-the-middle
attacker could use this flaw to trick MySQL clients into connecting to a
spoofed MySQL server. (CVE-2009-4028)

Note: This fix may uncover previously hidden SSL configuration issues, such
as incorrect CA certificates being used by clients or expired server
certificates. This update should be carefully tested in deployments where
SSL connections are used.

A flaw was found in the way MySQL handled SELECT statements with subqueries
in the WHERE clause, that assigned results to a user variable. A remote,
authenticated attacker could use this flaw to crash the MySQL server daemon
(mysqld). This issue only caused a temporary denial of service, as the
MySQL daemon was automatically restarted after the crash. (CVE-2009-4019)

When the "datadir" option was configured with a relative path, MySQL did
not properly check paths used as arguments for the DATA DIRECTORY and INDEX
DIRECTORY directives. An authenticated attacker could use this flaw to
bypass the restriction preventing the use of subdirectories of the MySQL
data directory being used as DATA DIRECTORY and INDEX DIRECTORY paths.
(CVE-2009-4030)

Note: Due to the security risks and previous security issues related to the
use of the DATA DIRECTORY and INDEX DIRECTORY directives, users not
depending on this feature should consider disabling it by adding
"symbolic-links=0" to the "[mysqld]" section of the "my.cnf" configuration
file. In this update, an example of such a configuration was added to the
default "my.cnf" file.

All MySQL users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. After installing this
update, the MySQL server daemon (mysqld) will be restarted automatically.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

540906 - CVE-2009-4019 mysql: DoS (crash) when comparing GIS items from subquery and when handling subqueires in WHERE and assigning a SELECT result to a @variable
541233 - CVE-2009-4028 mysql: client SSL certificate verification flaw
543653 - CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/mysql-5.0.77-4.el5_4.2.src.rpm

i386:
mysql-5.0.77-4.el5_4.2.i386.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.i386.rpm

x86_64:
mysql-5.0.77-4.el5_4.2.i386.rpm
mysql-5.0.77-4.el5_4.2.x86_64.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.i386.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/mysql-5.0.77-4.el5_4.2.src.rpm

i386:
mysql-bench-5.0.77-4.el5_4.2.i386.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.i386.rpm
mysql-devel-5.0.77-4.el5_4.2.i386.rpm
mysql-server-5.0.77-4.el5_4.2.i386.rpm
mysql-test-5.0.77-4.el5_4.2.i386.rpm

x86_64:
mysql-bench-5.0.77-4.el5_4.2.x86_64.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.i386.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.x86_64.rpm
mysql-devel-5.0.77-4.el5_4.2.i386.rpm
mysql-devel-5.0.77-4.el5_4.2.x86_64.rpm
mysql-server-5.0.77-4.el5_4.2.x86_64.rpm
mysql-test-5.0.77-4.el5_4.2.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/mysql-5.0.77-4.el5_4.2.src.rpm

i386:
mysql-5.0.77-4.el5_4.2.i386.rpm
mysql-bench-5.0.77-4.el5_4.2.i386.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.i386.rpm
mysql-devel-5.0.77-4.el5_4.2.i386.rpm
mysql-server-5.0.77-4.el5_4.2.i386.rpm
mysql-test-5.0.77-4.el5_4.2.i386.rpm

ia64:
mysql-5.0.77-4.el5_4.2.i386.rpm
mysql-5.0.77-4.el5_4.2.ia64.rpm
mysql-bench-5.0.77-4.el5_4.2.ia64.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.i386.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.ia64.rpm
mysql-devel-5.0.77-4.el5_4.2.ia64.rpm
mysql-server-5.0.77-4.el5_4.2.ia64.rpm
mysql-test-5.0.77-4.el5_4.2.ia64.rpm

ppc:
mysql-5.0.77-4.el5_4.2.ppc.rpm
mysql-5.0.77-4.el5_4.2.ppc64.rpm
mysql-bench-5.0.77-4.el5_4.2.ppc.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.ppc.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.ppc64.rpm
mysql-devel-5.0.77-4.el5_4.2.ppc.rpm
mysql-devel-5.0.77-4.el5_4.2.ppc64.rpm
mysql-server-5.0.77-4.el5_4.2.ppc.rpm
mysql-server-5.0.77-4.el5_4.2.ppc64.rpm
mysql-test-5.0.77-4.el5_4.2.ppc.rpm

s390x:
mysql-5.0.77-4.el5_4.2.s390.rpm
mysql-5.0.77-4.el5_4.2.s390x.rpm
mysql-bench-5.0.77-4.el5_4.2.s390x.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.s390.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.s390x.rpm
mysql-devel-5.0.77-4.el5_4.2.s390.rpm
mysql-devel-5.0.77-4.el5_4.2.s390x.rpm
mysql-server-5.0.77-4.el5_4.2.s390x.rpm
mysql-test-5.0.77-4.el5_4.2.s390x.rpm

x86_64:
mysql-5.0.77-4.el5_4.2.i386.rpm
mysql-5.0.77-4.el5_4.2.x86_64.rpm
mysql-bench-5.0.77-4.el5_4.2.x86_64.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.i386.rpm
mysql-debuginfo-5.0.77-4.el5_4.2.x86_64.rpm
mysql-devel-5.0.77-4.el5_4.2.i386.rpm
mysql-devel-5.0.77-4.el5_4.2.x86_64.rpm
mysql-server-5.0.77-4.el5_4.2.x86_64.rpm
mysql-test-5.0.77-4.el5_4.2.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2009-4019.html
https://www.redhat.com/security/data/cve/CVE-2009-4028.html
https://www.redhat.com/security/data/cve/CVE-2009-4030.html
http://www.redhat.com/security/updates/classification/#moderate
http://dev.mysql.com/doc/refman/5.0/en/symbolic-links-to-tables.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2010 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFLetCtXlSAg2UNWIIRApwjAKCtjHstUwwHC/dK5JEWxkP70TTuogCeLleI
LrQNccvqeEumUFk64LNBJRE=
=ZoKl
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

02-16-2010 04:07 PM
Moderate: mysql security update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: mysql security update
Advisory ID: RHSA-2010:0110-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0110.html
Issue date: 2010-02-16
CVE Names: CVE-2008-4098 CVE-2008-4456 CVE-2009-2446
CVE-2009-4030
================================================== ===================

1. Summary:

Updated mysql packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

Multiple flaws were discovered in the way MySQL handled symbolic links to
tables created using the DATA DIRECTORY and INDEX DIRECTORY directives in
CREATE TABLE statements. An attacker with CREATE and DROP table privileges
and shell access to the database server could use these flaws to escalate
their database privileges, or gain access to tables created by other
database users. (CVE-2008-4098, CVE-2009-4030)

Note: Due to the security risks and previous security issues related to the
use of the DATA DIRECTORY and INDEX DIRECTORY directives, users not
depending on this feature should consider disabling it by adding
"symbolic-links=0" to the "[mysqld]" section of the "my.cnf" configuration
file. In this update, an example of such a configuration was added to the
default "my.cnf" file.

An insufficient HTML entities quoting flaw was found in the mysql command
line client's HTML output mode. If an attacker was able to inject arbitrary
HTML tags into data stored in a MySQL database, which was later retrieved
using the mysql command line client and its HTML output mode, they could
perform a cross-site scripting (XSS) attack against victims viewing the
HTML output in a web browser. (CVE-2008-4456)

Multiple format string flaws were found in the way the MySQL server logged
user commands when creating and deleting databases. A remote, authenticated
attacker with permissions to CREATE and DROP databases could use these
flaws to formulate a specially-crafted SQL command that would cause a
temporary denial of service (open connections to mysqld are terminated).
(CVE-2009-2446)

Note: To exploit the CVE-2009-2446 flaws, the general query log (the mysqld
"--log" command line option or the "log" option in "my.cnf") must be
enabled. This logging is not enabled by default.

All MySQL users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. After installing this
update, the MySQL server daemon (mysqld) will be restarted automatically.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

454077 - CVE-2008-4098 mysql: incomplete upstream fix for CVE-2008-2079
466518 - CVE-2008-4456 mysql: mysql command line client XSS flaw
511020 - CVE-2009-2446 MySQL: Format string vulnerability by manipulation with database instances (crash)
543653 - CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/mysql-4.1.22-2.el4_8.3.src.rpm

i386:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-bench-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-devel-4.1.22-2.el4_8.3.i386.rpm
mysql-server-4.1.22-2.el4_8.3.i386.rpm

ia64:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-4.1.22-2.el4_8.3.ia64.rpm
mysql-bench-4.1.22-2.el4_8.3.ia64.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.ia64.rpm
mysql-devel-4.1.22-2.el4_8.3.ia64.rpm
mysql-server-4.1.22-2.el4_8.3.ia64.rpm

ppc:
mysql-4.1.22-2.el4_8.3.ppc.rpm
mysql-4.1.22-2.el4_8.3.ppc64.rpm
mysql-bench-4.1.22-2.el4_8.3.ppc.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.ppc.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.ppc64.rpm
mysql-devel-4.1.22-2.el4_8.3.ppc.rpm
mysql-server-4.1.22-2.el4_8.3.ppc.rpm

s390:
mysql-4.1.22-2.el4_8.3.s390.rpm
mysql-bench-4.1.22-2.el4_8.3.s390.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.s390.rpm
mysql-devel-4.1.22-2.el4_8.3.s390.rpm
mysql-server-4.1.22-2.el4_8.3.s390.rpm

s390x:
mysql-4.1.22-2.el4_8.3.s390.rpm
mysql-4.1.22-2.el4_8.3.s390x.rpm
mysql-bench-4.1.22-2.el4_8.3.s390x.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.s390.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.s390x.rpm
mysql-devel-4.1.22-2.el4_8.3.s390x.rpm
mysql-server-4.1.22-2.el4_8.3.s390x.rpm

x86_64:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-4.1.22-2.el4_8.3.x86_64.rpm
mysql-bench-4.1.22-2.el4_8.3.x86_64.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.x86_64.rpm
mysql-devel-4.1.22-2.el4_8.3.x86_64.rpm
mysql-server-4.1.22-2.el4_8.3.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/mysql-4.1.22-2.el4_8.3.src.rpm

i386:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-bench-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-devel-4.1.22-2.el4_8.3.i386.rpm
mysql-server-4.1.22-2.el4_8.3.i386.rpm

x86_64:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-4.1.22-2.el4_8.3.x86_64.rpm
mysql-bench-4.1.22-2.el4_8.3.x86_64.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.x86_64.rpm
mysql-devel-4.1.22-2.el4_8.3.x86_64.rpm
mysql-server-4.1.22-2.el4_8.3.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/mysql-4.1.22-2.el4_8.3.src.rpm

i386:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-bench-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-devel-4.1.22-2.el4_8.3.i386.rpm
mysql-server-4.1.22-2.el4_8.3.i386.rpm

ia64:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-4.1.22-2.el4_8.3.ia64.rpm
mysql-bench-4.1.22-2.el4_8.3.ia64.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.ia64.rpm
mysql-devel-4.1.22-2.el4_8.3.ia64.rpm
mysql-server-4.1.22-2.el4_8.3.ia64.rpm

x86_64:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-4.1.22-2.el4_8.3.x86_64.rpm
mysql-bench-4.1.22-2.el4_8.3.x86_64.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.x86_64.rpm
mysql-devel-4.1.22-2.el4_8.3.x86_64.rpm
mysql-server-4.1.22-2.el4_8.3.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/mysql-4.1.22-2.el4_8.3.src.rpm

i386:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-bench-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-devel-4.1.22-2.el4_8.3.i386.rpm
mysql-server-4.1.22-2.el4_8.3.i386.rpm

ia64:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-4.1.22-2.el4_8.3.ia64.rpm
mysql-bench-4.1.22-2.el4_8.3.ia64.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.ia64.rpm
mysql-devel-4.1.22-2.el4_8.3.ia64.rpm
mysql-server-4.1.22-2.el4_8.3.ia64.rpm

x86_64:
mysql-4.1.22-2.el4_8.3.i386.rpm
mysql-4.1.22-2.el4_8.3.x86_64.rpm
mysql-bench-4.1.22-2.el4_8.3.x86_64.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.3.x86_64.rpm
mysql-devel-4.1.22-2.el4_8.3.x86_64.rpm
mysql-server-4.1.22-2.el4_8.3.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2008-4098.html
https://www.redhat.com/security/data/cve/CVE-2008-4456.html
https://www.redhat.com/security/data/cve/CVE-2009-2446.html
https://www.redhat.com/security/data/cve/CVE-2009-4030.html
http://www.redhat.com/security/updates/classification/#moderate
http://dev.mysql.com/doc/refman/4.1/en/symbolic-links-to-tables.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2010 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFLetDDXlSAg2UNWIIRAoWjAJ9RvlmdBumZmN25fgUAan KP0QHAkgCgwM5T
qvDAHsmhNIQSgHkxM8KCFc0=
=+LfE
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

11-03-2010 07:25 PM
Moderate: mysql security update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: mysql security update
Advisory ID: RHSA-2010:0824-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0824.html
Issue date: 2010-11-03
CVE Names: CVE-2010-1848 CVE-2010-3681 CVE-2010-3840
================================================== ===================

1. Summary:

Updated mysql packages that fix three security issues are now available for
Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the MySQL PolyFromWKB() function did not sanity check
Well-Known Binary (WKB) data. A remote, authenticated attacker could use
specially-crafted WKB data to crash mysqld. This issue only caused a
temporary denial of service, as mysqld was automatically restarted after
the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain alternating READ
requests provided by HANDLER statements. A remote, authenticated attacker
could use this flaw to provide such requests, causing mysqld to crash. This
issue only caused a temporary denial of service, as mysqld was
automatically restarted after the crash. (CVE-2010-3681)

A directory traversal flaw was found in the way MySQL handled the
parameters of the MySQL COM_FIELD_LIST network protocol command. A remote,
authenticated attacker could use this flaw to obtain descriptions of the
fields of an arbitrary table using a request with a specially-crafted
table name. (CVE-2010-1848)

All MySQL users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. After installing this
update, the MySQL server daemon (mysqld) will be restarted automatically.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

592079 - CVE-2010-1848 mysql: multiple insufficient table name checks
628680 - CVE-2010-3681 MySQL: mysqld DoS (assertion failure) by alternate reads from two indexes on a table using the HANDLER interface (MySQL bug #54007)
640865 - CVE-2010-3840 MySQL: crash when loading data into geometry function PolyFromWKB() (MySQL Bug#51875)

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/mysql-4.1.22-2.el4_8.4.src.rpm

i386:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-bench-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-devel-4.1.22-2.el4_8.4.i386.rpm
mysql-server-4.1.22-2.el4_8.4.i386.rpm

ia64:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-4.1.22-2.el4_8.4.ia64.rpm
mysql-bench-4.1.22-2.el4_8.4.ia64.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.ia64.rpm
mysql-devel-4.1.22-2.el4_8.4.ia64.rpm
mysql-server-4.1.22-2.el4_8.4.ia64.rpm

ppc:
mysql-4.1.22-2.el4_8.4.ppc.rpm
mysql-4.1.22-2.el4_8.4.ppc64.rpm
mysql-bench-4.1.22-2.el4_8.4.ppc.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.ppc.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.ppc64.rpm
mysql-devel-4.1.22-2.el4_8.4.ppc.rpm
mysql-server-4.1.22-2.el4_8.4.ppc.rpm

s390:
mysql-4.1.22-2.el4_8.4.s390.rpm
mysql-bench-4.1.22-2.el4_8.4.s390.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.s390.rpm
mysql-devel-4.1.22-2.el4_8.4.s390.rpm
mysql-server-4.1.22-2.el4_8.4.s390.rpm

s390x:
mysql-4.1.22-2.el4_8.4.s390.rpm
mysql-4.1.22-2.el4_8.4.s390x.rpm
mysql-bench-4.1.22-2.el4_8.4.s390x.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.s390.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.s390x.rpm
mysql-devel-4.1.22-2.el4_8.4.s390x.rpm
mysql-server-4.1.22-2.el4_8.4.s390x.rpm

x86_64:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-4.1.22-2.el4_8.4.x86_64.rpm
mysql-bench-4.1.22-2.el4_8.4.x86_64.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.x86_64.rpm
mysql-devel-4.1.22-2.el4_8.4.x86_64.rpm
mysql-server-4.1.22-2.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/mysql-4.1.22-2.el4_8.4.src.rpm

i386:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-bench-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-devel-4.1.22-2.el4_8.4.i386.rpm
mysql-server-4.1.22-2.el4_8.4.i386.rpm

x86_64:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-4.1.22-2.el4_8.4.x86_64.rpm
mysql-bench-4.1.22-2.el4_8.4.x86_64.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.x86_64.rpm
mysql-devel-4.1.22-2.el4_8.4.x86_64.rpm
mysql-server-4.1.22-2.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/mysql-4.1.22-2.el4_8.4.src.rpm

i386:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-bench-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-devel-4.1.22-2.el4_8.4.i386.rpm
mysql-server-4.1.22-2.el4_8.4.i386.rpm

ia64:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-4.1.22-2.el4_8.4.ia64.rpm
mysql-bench-4.1.22-2.el4_8.4.ia64.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.ia64.rpm
mysql-devel-4.1.22-2.el4_8.4.ia64.rpm
mysql-server-4.1.22-2.el4_8.4.ia64.rpm

x86_64:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-4.1.22-2.el4_8.4.x86_64.rpm
mysql-bench-4.1.22-2.el4_8.4.x86_64.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.x86_64.rpm
mysql-devel-4.1.22-2.el4_8.4.x86_64.rpm
mysql-server-4.1.22-2.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/mysql-4.1.22-2.el4_8.4.src.rpm

i386:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-bench-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-devel-4.1.22-2.el4_8.4.i386.rpm
mysql-server-4.1.22-2.el4_8.4.i386.rpm

ia64:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-4.1.22-2.el4_8.4.ia64.rpm
mysql-bench-4.1.22-2.el4_8.4.ia64.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.ia64.rpm
mysql-devel-4.1.22-2.el4_8.4.ia64.rpm
mysql-server-4.1.22-2.el4_8.4.ia64.rpm

x86_64:
mysql-4.1.22-2.el4_8.4.i386.rpm
mysql-4.1.22-2.el4_8.4.x86_64.rpm
mysql-bench-4.1.22-2.el4_8.4.x86_64.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm
mysql-debuginfo-4.1.22-2.el4_8.4.x86_64.rpm
mysql-devel-4.1.22-2.el4_8.4.x86_64.rpm
mysql-server-4.1.22-2.el4_8.4.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2010-1848.html
https://www.redhat.com/security/data/cve/CVE-2010-3681.html
https://www.redhat.com/security/data/cve/CVE-2010-3840.html
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2010 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFM0cU9XlSAg2UNWIIRAlBNAJ0a0OPlJ0RUhK/utVpRoDurUbZBUACcCfZD
ezF/WWIx2e8Ra4Uj03UuhBw=
=OctO
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

11-03-2010 07:27 PM
Moderate: mysql security update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: mysql security update
Advisory ID: RHSA-2010:0825-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0825.html
Issue date: 2010-11-03
CVE Names: CVE-2010-3677 CVE-2010-3680 CVE-2010-3681
CVE-2010-3682 CVE-2010-3833 CVE-2010-3835
CVE-2010-3836 CVE-2010-3837 CVE-2010-3838
CVE-2010-3839 CVE-2010-3840
================================================== ===================

1. Summary:

Updated mysql packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

3. Description:

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the MySQL PolyFromWKB() function did not sanity check
Well-Known Binary (WKB) data. A remote, authenticated attacker could use
specially-crafted WKB data to crash mysqld. This issue only caused a
temporary denial of service, as mysqld was automatically restarted after
the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain JOIN queries. If a
stored procedure contained JOIN queries, and that procedure was executed
twice in sequence, it could cause an infinite loop, leading to excessive
CPU use (up to 100%). A remote, authenticated attacker could use this flaw
to cause a denial of service. (CVE-2010-3839)

A flaw was found in the way MySQL processed queries that provide a mixture
of numeric and longblob data types to the LEAST or GREATEST function. A
remote, authenticated attacker could use this flaw to crash mysqld. This
issue only caused a temporary denial of service, as mysqld was
automatically restarted after the crash. (CVE-2010-3838)

A flaw was found in the way MySQL processed PREPARE statements containing
both GROUP_CONCAT and the WITH ROLLUP modifier. A remote, authenticated
attacker could use this flaw to crash mysqld. This issue only caused a
temporary denial of service, as mysqld was automatically restarted after
the crash. (CVE-2010-3837)

It was found that MySQL did not properly pre-evaluate LIKE arguments in
view prepare mode. A remote, authenticated attacker could possibly use this
flaw to crash mysqld. (CVE-2010-3836)

A flaw was found in the way MySQL processed statements that assign a value
to a user-defined variable and that also contain a logical value
evaluation. A remote, authenticated attacker could use this flaw to crash
mysqld. This issue only caused a temporary denial of service, as mysqld was
automatically restarted after the crash. (CVE-2010-3835)

A flaw was found in the way MySQL evaluated the arguments of extreme-value
functions, such as LEAST and GREATEST. A remote, authenticated attacker
could use this flaw to crash mysqld. This issue only caused a temporary
denial of service, as mysqld was automatically restarted after the crash.
(CVE-2010-3833)

A flaw was found in the way MySQL processed EXPLAIN statements for some
complex SELECT queries. A remote, authenticated attacker could use this
flaw to crash mysqld. This issue only caused a temporary denial of service,
as mysqld was automatically restarted after the crash. (CVE-2010-3682)

A flaw was found in the way MySQL processed certain alternating READ
requests provided by HANDLER statements. A remote, authenticated attacker
could use this flaw to provide such requests, causing mysqld to crash. This
issue only caused a temporary denial of service, as mysqld was
automatically restarted after the crash. (CVE-2010-3681)

A flaw was found in the way MySQL processed CREATE TEMPORARY TABLE
statements that define NULL columns when using the InnoDB storage engine. A
remote, authenticated attacker could use this flaw to crash mysqld. This
issue only caused a temporary denial of service, as mysqld was
automatically restarted after the crash. (CVE-2010-3680)

A flaw was found in the way MySQL processed JOIN queries that attempt to
retrieve data from a unique SET column. A remote, authenticated attacker
could use this flaw to crash mysqld. This issue only caused a temporary
denial of service, as mysqld was automatically restarted after the crash.
(CVE-2010-3677)

All MySQL users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. After installing this
update, the MySQL server daemon (mysqld) will be restarted automatically.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

628040 - CVE-2010-3677 MySQL: Mysqld DoS (crash) by processing joins involving a table with a unique SET column (MySQL BZ#54575)
628192 - CVE-2010-3680 MySQL: mysqld DoS (assertion failure) by using temporary InnoDB engine tables with nullable columns (MySQL bug #54044)
628328 - CVE-2010-3682 MySQL: mysqld DoS (crash) by processing EXPLAIN statements for complex SQL queries (MySQL bug #52711)
628680 - CVE-2010-3681 MySQL: mysqld DoS (assertion failure) by alternate reads from two indexes on a table using the HANDLER interface (MySQL bug #54007)
640751 - CVE-2010-3833 MySQL: CREATE TABLE ... SELECT causes crash when KILL_BAD_DATA is returned (MySQL Bug#55826)
640819 - CVE-2010-3835 MySQL: crash with user variables, assignments, joins... (MySQL Bug #55564)
640845 - CVE-2010-3836 MySQL: pre-evaluating LIKE arguments in view prepare mode causes crash (MySQL Bug#54568)
640856 - CVE-2010-3837 MySQL: crash when group_concat and "with rollup" in prepared statements (MySQL Bug#54476)
640858 - CVE-2010-3838 MySQL: crash with LONGBLOB and union or update with subquery (MySQL Bug#54461)
640861 - CVE-2010-3839 MySQL: server hangs during JOIN query in stored procedures called twice in a row (MySQL Bug#53544)
640865 - CVE-2010-3840 MySQL: crash when loading data into geometry function PolyFromWKB() (MySQL Bug#51875)

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/mysql-5.0.77-4.el5_5.4.src.rpm

i386:
mysql-5.0.77-4.el5_5.4.i386.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.i386.rpm

x86_64:
mysql-5.0.77-4.el5_5.4.i386.rpm
mysql-5.0.77-4.el5_5.4.x86_64.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.i386.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/mysql-5.0.77-4.el5_5.4.src.rpm

i386:
mysql-bench-5.0.77-4.el5_5.4.i386.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.i386.rpm
mysql-devel-5.0.77-4.el5_5.4.i386.rpm
mysql-server-5.0.77-4.el5_5.4.i386.rpm
mysql-test-5.0.77-4.el5_5.4.i386.rpm

x86_64:
mysql-bench-5.0.77-4.el5_5.4.x86_64.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.i386.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.x86_64.rpm
mysql-devel-5.0.77-4.el5_5.4.i386.rpm
mysql-devel-5.0.77-4.el5_5.4.x86_64.rpm
mysql-server-5.0.77-4.el5_5.4.x86_64.rpm
mysql-test-5.0.77-4.el5_5.4.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/mysql-5.0.77-4.el5_5.4.src.rpm

i386:
mysql-5.0.77-4.el5_5.4.i386.rpm
mysql-bench-5.0.77-4.el5_5.4.i386.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.i386.rpm
mysql-devel-5.0.77-4.el5_5.4.i386.rpm
mysql-server-5.0.77-4.el5_5.4.i386.rpm
mysql-test-5.0.77-4.el5_5.4.i386.rpm

ia64:
mysql-5.0.77-4.el5_5.4.i386.rpm
mysql-5.0.77-4.el5_5.4.ia64.rpm
mysql-bench-5.0.77-4.el5_5.4.ia64.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.i386.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.ia64.rpm
mysql-devel-5.0.77-4.el5_5.4.ia64.rpm
mysql-server-5.0.77-4.el5_5.4.ia64.rpm
mysql-test-5.0.77-4.el5_5.4.ia64.rpm

ppc:
mysql-5.0.77-4.el5_5.4.ppc.rpm
mysql-5.0.77-4.el5_5.4.ppc64.rpm
mysql-bench-5.0.77-4.el5_5.4.ppc.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.ppc.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.ppc64.rpm
mysql-devel-5.0.77-4.el5_5.4.ppc.rpm
mysql-devel-5.0.77-4.el5_5.4.ppc64.rpm
mysql-server-5.0.77-4.el5_5.4.ppc.rpm
mysql-server-5.0.77-4.el5_5.4.ppc64.rpm
mysql-test-5.0.77-4.el5_5.4.ppc.rpm

s390x:
mysql-5.0.77-4.el5_5.4.s390.rpm
mysql-5.0.77-4.el5_5.4.s390x.rpm
mysql-bench-5.0.77-4.el5_5.4.s390x.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.s390.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.s390x.rpm
mysql-devel-5.0.77-4.el5_5.4.s390.rpm
mysql-devel-5.0.77-4.el5_5.4.s390x.rpm
mysql-server-5.0.77-4.el5_5.4.s390x.rpm
mysql-test-5.0.77-4.el5_5.4.s390x.rpm

x86_64:
mysql-5.0.77-4.el5_5.4.i386.rpm
mysql-5.0.77-4.el5_5.4.x86_64.rpm
mysql-bench-5.0.77-4.el5_5.4.x86_64.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.i386.rpm
mysql-debuginfo-5.0.77-4.el5_5.4.x86_64.rpm
mysql-devel-5.0.77-4.el5_5.4.i386.rpm
mysql-devel-5.0.77-4.el5_5.4.x86_64.rpm
mysql-server-5.0.77-4.el5_5.4.x86_64.rpm
mysql-test-5.0.77-4.el5_5.4.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2010-3677.html
https://www.redhat.com/security/data/cve/CVE-2010-3680.html
https://www.redhat.com/security/data/cve/CVE-2010-3681.html
https://www.redhat.com/security/data/cve/CVE-2010-3682.html
https://www.redhat.com/security/data/cve/CVE-2010-3833.html
https://www.redhat.com/security/data/cve/CVE-2010-3835.html
https://www.redhat.com/security/data/cve/CVE-2010-3836.html
https://www.redhat.com/security/data/cve/CVE-2010-3837.html
https://www.redhat.com/security/data/cve/CVE-2010-3838.html
https://www.redhat.com/security/data/cve/CVE-2010-3839.html
https://www.redhat.com/security/data/cve/CVE-2010-3840.html
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2010 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFM0cVeXlSAg2UNWIIRAo2wAJ9El7FssRd8ARHXSNUF/tRwiLmHgwCfczvp
GlADjy9lPl4R9Kp2zumFuuU=
=z1hX
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

01-18-2011 06:07 PM
Moderate: mysql security update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: mysql security update
Advisory ID: RHSA-2011:0164-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-0164.html
Issue date: 2011-01-18
CVE Names: CVE-2010-3677 CVE-2010-3678 CVE-2010-3679
CVE-2010-3680 CVE-2010-3681 CVE-2010-3682
CVE-2010-3683 CVE-2010-3833 CVE-2010-3835
CVE-2010-3836 CVE-2010-3837 CVE-2010-3838
CVE-2010-3839 CVE-2010-3840
================================================== ===================

1. Summary:

Updated mysql packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

The MySQL PolyFromWKB() function did not sanity check Well-Known Binary
(WKB) data, which could allow a remote, authenticated attacker to crash
mysqld. (CVE-2010-3840)

A flaw in the way MySQL processed certain JOIN queries could allow a
remote, authenticated attacker to cause excessive CPU use (up to 100%), if
a stored procedure contained JOIN queries, and that procedure was executed
twice in sequence. (CVE-2010-3839)

A flaw in the way MySQL processed queries that provide a mixture of numeric
and longblob data types to the LEAST or GREATEST function, could allow a
remote, authenticated attacker to crash mysqld. (CVE-2010-3838)

A flaw in the way MySQL processed PREPARE statements containing both
GROUP_CONCAT and the WITH ROLLUP modifier could allow a remote,
authenticated attacker to crash mysqld. (CVE-2010-3837)

MySQL did not properly pre-evaluate LIKE arguments in view prepare mode,
possibly allowing a remote, authenticated attacker to crash mysqld.
(CVE-2010-3836)

A flaw in the way MySQL processed statements that assign a value to a
user-defined variable and that also contain a logical value evaluation
could allow a remote, authenticated attacker to crash mysqld.
(CVE-2010-3835)

A flaw in the way MySQL evaluated the arguments of extreme-value functions,
such as LEAST and GREATEST, could allow a remote, authenticated attacker to
crash mysqld. (CVE-2010-3833)

A flaw in the way MySQL handled LOAD DATA INFILE requests allowed MySQL to
send OK packets even when there were errors. (CVE-2010-3683)

A flaw in the way MySQL processed EXPLAIN statements for some complex
SELECT queries could allow a remote, authenticated attacker to crash
mysqld. (CVE-2010-3682)

A flaw in the way MySQL processed certain alternating READ requests
provided by HANDLER statements could allow a remote, authenticated attacker
to crash mysqld. (CVE-2010-3681)

A flaw in the way MySQL processed CREATE TEMPORARY TABLE statements that
define NULL columns when using the InnoDB storage engine, could allow a
remote, authenticated attacker to crash mysqld. (CVE-2010-3680)

A flaw in the way MySQL processed certain values provided to the BINLOG
statement caused MySQL to read unassigned memory. A remote, authenticated
attacker could possibly use this flaw to crash mysqld. (CVE-2010-3679)

A flaw in the way MySQL processed SQL queries containing IN or CASE
statements, when a NULL argument was provided as one of the arguments to
the query, could allow a remote, authenticated attacker to crash mysqld.
(CVE-2010-3678)

A flaw in the way MySQL processed JOIN queries that attempt to retrieve
data from a unique SET column could allow a remote, authenticated attacker
to crash mysqld. (CVE-2010-3677)

Note: CVE-2010-3840, CVE-2010-3838, CVE-2010-3837, CVE-2010-3835,
CVE-2010-3833, CVE-2010-3682, CVE-2010-3681, CVE-2010-3680, CVE-2010-3678,
and CVE-2010-3677 only cause a temporary denial of service, as mysqld was
automatically restarted after each crash.

These updated packages upgrade MySQL to version 5.1.52. Refer to the MySQL
release notes for a full list of changes:

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html

All MySQL users should upgrade to these updated packages, which correct
these issues. After installing this update, the MySQL server daemon
(mysqld) will be restarted automatically.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

628040 - CVE-2010-3677 MySQL: Mysqld DoS (crash) by processing joins involving a table with a unique SET column (MySQL BZ#54575)
628062 - CVE-2010-3679 MySQL: Use of unassigned memory (valgrind errors / crash) by providing certain values to BINLOG statement (MySQL BZ#54393)
628172 - CVE-2010-3678 MySQL: mysqld DoS (crash) by processing IN / CASE statements with NULL arguments (MySQL bug #54477)
628192 - CVE-2010-3680 MySQL: mysqld DoS (assertion failure) by using temporary InnoDB engine tables with nullable columns (MySQL bug #54044)
628328 - CVE-2010-3682 MySQL: mysqld DoS (crash) by processing EXPLAIN statements for complex SQL queries (MySQL bug #52711)
628680 - CVE-2010-3681 MySQL: mysqld DoS (assertion failure) by alternate reads from two indexes on a table using the HANDLER interface (MySQL bug #54007)
628698 - CVE-2010-3683 MySQL: mysqld DoS (assertion failure) while reading the file back into a table (MySQL bug #52512)
640751 - CVE-2010-3833 MySQL: CREATE TABLE ... SELECT causes crash when KILL_BAD_DATA is returned (MySQL Bug#55826)
640819 - CVE-2010-3835 MySQL: crash with user variables, assignments, joins... (MySQL Bug #55564)
640845 - CVE-2010-3836 MySQL: pre-evaluating LIKE arguments in view prepare mode causes crash (MySQL Bug#54568)
640856 - CVE-2010-3837 MySQL: crash when group_concat and "with rollup" in prepared statements (MySQL Bug#54476)
640858 - CVE-2010-3838 MySQL: crash with LONGBLOB and union or update with subquery (MySQL Bug#54461)
640861 - CVE-2010-3839 MySQL: server hangs during JOIN query in stored procedures called twice in a row (MySQL Bug#53544)
640865 - CVE-2010-3840 MySQL: crash when loading data into geometry function PolyFromWKB() (MySQL Bug#51875)

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/mysql-5.1.52-1.el6_0.1.src.rpm

i386:
mysql-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-libs-5.1.52-1.el6_0.1.i686.rpm
mysql-server-5.1.52-1.el6_0.1.i686.rpm

x86_64:
mysql-5.1.52-1.el6_0.1.x86_64.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.x86_64.rpm
mysql-libs-5.1.52-1.el6_0.1.i686.rpm
mysql-libs-5.1.52-1.el6_0.1.x86_64.rpm
mysql-server-5.1.52-1.el6_0.1.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/mysql-5.1.52-1.el6_0.1.src.rpm

i386:
mysql-bench-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-test-5.1.52-1.el6_0.1.i686.rpm

x86_64:
mysql-bench-5.1.52-1.el6_0.1.x86_64.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.x86_64.rpm
mysql-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-devel-5.1.52-1.el6_0.1.x86_64.rpm
mysql-embedded-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-5.1.52-1.el6_0.1.x86_64.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.x86_64.rpm
mysql-test-5.1.52-1.el6_0.1.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/mysql-5.1.52-1.el6_0.1.src.rpm

x86_64:
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.x86_64.rpm
mysql-libs-5.1.52-1.el6_0.1.i686.rpm
mysql-libs-5.1.52-1.el6_0.1.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/mysql-5.1.52-1.el6_0.1.src.rpm

x86_64:
mysql-5.1.52-1.el6_0.1.x86_64.rpm
mysql-bench-5.1.52-1.el6_0.1.x86_64.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.x86_64.rpm
mysql-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-devel-5.1.52-1.el6_0.1.x86_64.rpm
mysql-embedded-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-5.1.52-1.el6_0.1.x86_64.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.x86_64.rpm
mysql-server-5.1.52-1.el6_0.1.x86_64.rpm
mysql-test-5.1.52-1.el6_0.1.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/mysql-5.1.52-1.el6_0.1.src.rpm

i386:
mysql-5.1.52-1.el6_0.1.i686.rpm
mysql-bench-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-libs-5.1.52-1.el6_0.1.i686.rpm
mysql-server-5.1.52-1.el6_0.1.i686.rpm
mysql-test-5.1.52-1.el6_0.1.i686.rpm

ppc64:
mysql-5.1.52-1.el6_0.1.ppc64.rpm
mysql-bench-5.1.52-1.el6_0.1.ppc64.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.ppc.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.ppc64.rpm
mysql-devel-5.1.52-1.el6_0.1.ppc.rpm
mysql-devel-5.1.52-1.el6_0.1.ppc64.rpm
mysql-libs-5.1.52-1.el6_0.1.ppc.rpm
mysql-libs-5.1.52-1.el6_0.1.ppc64.rpm
mysql-server-5.1.52-1.el6_0.1.ppc64.rpm
mysql-test-5.1.52-1.el6_0.1.ppc64.rpm

s390x:
mysql-5.1.52-1.el6_0.1.s390x.rpm
mysql-bench-5.1.52-1.el6_0.1.s390x.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.s390.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.s390x.rpm
mysql-devel-5.1.52-1.el6_0.1.s390.rpm
mysql-devel-5.1.52-1.el6_0.1.s390x.rpm
mysql-libs-5.1.52-1.el6_0.1.s390.rpm
mysql-libs-5.1.52-1.el6_0.1.s390x.rpm
mysql-server-5.1.52-1.el6_0.1.s390x.rpm
mysql-test-5.1.52-1.el6_0.1.s390x.rpm

x86_64:
mysql-5.1.52-1.el6_0.1.x86_64.rpm
mysql-bench-5.1.52-1.el6_0.1.x86_64.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.x86_64.rpm
mysql-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-devel-5.1.52-1.el6_0.1.x86_64.rpm
mysql-libs-5.1.52-1.el6_0.1.i686.rpm
mysql-libs-5.1.52-1.el6_0.1.x86_64.rpm
mysql-server-5.1.52-1.el6_0.1.x86_64.rpm
mysql-test-5.1.52-1.el6_0.1.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/mysql-5.1.52-1.el6_0.1.src.rpm

i386:
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.i686.rpm

ppc64:
mysql-debuginfo-5.1.52-1.el6_0.1.ppc.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.ppc64.rpm
mysql-embedded-5.1.52-1.el6_0.1.ppc.rpm
mysql-embedded-5.1.52-1.el6_0.1.ppc64.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.ppc.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.ppc64.rpm

s390x:
mysql-debuginfo-5.1.52-1.el6_0.1.s390.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.s390x.rpm
mysql-embedded-5.1.52-1.el6_0.1.s390.rpm
mysql-embedded-5.1.52-1.el6_0.1.s390x.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.s390.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.s390x.rpm

x86_64:
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.x86_64.rpm
mysql-embedded-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-5.1.52-1.el6_0.1.x86_64.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/mysql-5.1.52-1.el6_0.1.src.rpm

i386:
mysql-5.1.52-1.el6_0.1.i686.rpm
mysql-bench-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-libs-5.1.52-1.el6_0.1.i686.rpm
mysql-server-5.1.52-1.el6_0.1.i686.rpm
mysql-test-5.1.52-1.el6_0.1.i686.rpm

x86_64:
mysql-5.1.52-1.el6_0.1.x86_64.rpm
mysql-bench-5.1.52-1.el6_0.1.x86_64.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.x86_64.rpm
mysql-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-devel-5.1.52-1.el6_0.1.x86_64.rpm
mysql-libs-5.1.52-1.el6_0.1.i686.rpm
mysql-libs-5.1.52-1.el6_0.1.x86_64.rpm
mysql-server-5.1.52-1.el6_0.1.x86_64.rpm
mysql-test-5.1.52-1.el6_0.1.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/mysql-5.1.52-1.el6_0.1.src.rpm

i386:
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.i686.rpm

x86_64:
mysql-debuginfo-5.1.52-1.el6_0.1.i686.rpm
mysql-debuginfo-5.1.52-1.el6_0.1.x86_64.rpm
mysql-embedded-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-5.1.52-1.el6_0.1.x86_64.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.i686.rpm
mysql-embedded-devel-5.1.52-1.el6_0.1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2010-3677.html
https://www.redhat.com/security/data/cve/CVE-2010-3678.html
https://www.redhat.com/security/data/cve/CVE-2010-3679.html
https://www.redhat.com/security/data/cve/CVE-2010-3680.html
https://www.redhat.com/security/data/cve/CVE-2010-3681.html
https://www.redhat.com/security/data/cve/CVE-2010-3682.html
https://www.redhat.com/security/data/cve/CVE-2010-3683.html
https://www.redhat.com/security/data/cve/CVE-2010-3833.html
https://www.redhat.com/security/data/cve/CVE-2010-3835.html
https://www.redhat.com/security/data/cve/CVE-2010-3836.html
https://www.redhat.com/security/data/cve/CVE-2010-3837.html
https://www.redhat.com/security/data/cve/CVE-2010-3838.html
https://www.redhat.com/security/data/cve/CVE-2010-3839.html
https://www.redhat.com/security/data/cve/CVE-2010-3840.html
https://access.redhat.com/security/updates/classification/#moderate
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2011 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFNNeTGXlSAg2UNWIIRAtO6AKCaOVsBESqgXd2DThHKZf vn2N+QAACdGpcW
7wmKb21ORpkWLQHWLBEdcoY=
=+/5s
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

02-13-2012 07:39 PM
Moderate: mysql security update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: mysql security update
Advisory ID: RHSA-2012:0127-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0127.html
Issue date: 2012-02-13
CVE Names: CVE-2012-0075 CVE-2012-0087 CVE-2012-0101
CVE-2012-0102 CVE-2012-0114 CVE-2012-0484
CVE-2012-0490
================================================== ===================

1. Summary:

Updated mysql packages that fix several security issues are now available
for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

3. Description:

MySQL is a multi-user, multi-threaded SQL database server. It consists of
the MySQL server daemon (mysqld) and many client programs and libraries.

This update fixes several vulnerabilities in the MySQL database server.
Information about these flaws can be found on the Oracle Critical Patch
Update Advisory page, listed in the References section. (CVE-2012-0075,
CVE-2012-0087, CVE-2012-0101, CVE-2012-0102, CVE-2012-0114, CVE-2012-0484,
CVE-2012-0490)

These updated packages upgrade MySQL to version 5.0.95. Refer to the MySQL
release notes for a full list of changes:

http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html

All MySQL users should upgrade to these updated packages, which correct
these issues. After installing this update, the MySQL server daemon
(mysqld) will be restarted automatically.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

783794 - CVE-2012-0075 mysql: Unspecified vulnerability allows remote authenticated users to affect integrity
783795 - CVE-2012-0087 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783797 - CVE-2012-0101 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783798 - CVE-2012-0102 mysql: Unspecified vulnerability allows remote authenticated users to affect availability
783801 - CVE-2012-0114 mysql: Unspecified vulnerability allows local users to affect confidentiality and integrity
783808 - CVE-2012-0484 mysql: Unspecified vulnerability allows remote authenticated users to affect confidentiality
783815 - CVE-2012-0490 mysql: Unspecified vulnerability allows remote authenticated users to affect availability

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/mysql-5.0.95-1.el5_7.1.src.rpm

i386:
mysql-5.0.95-1.el5_7.1.i386.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.i386.rpm

x86_64:
mysql-5.0.95-1.el5_7.1.i386.rpm
mysql-5.0.95-1.el5_7.1.x86_64.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.i386.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/mysql-5.0.95-1.el5_7.1.src.rpm

i386:
mysql-bench-5.0.95-1.el5_7.1.i386.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.i386.rpm
mysql-devel-5.0.95-1.el5_7.1.i386.rpm
mysql-server-5.0.95-1.el5_7.1.i386.rpm
mysql-test-5.0.95-1.el5_7.1.i386.rpm

x86_64:
mysql-bench-5.0.95-1.el5_7.1.x86_64.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.i386.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.x86_64.rpm
mysql-devel-5.0.95-1.el5_7.1.i386.rpm
mysql-devel-5.0.95-1.el5_7.1.x86_64.rpm
mysql-server-5.0.95-1.el5_7.1.x86_64.rpm
mysql-test-5.0.95-1.el5_7.1.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/mysql-5.0.95-1.el5_7.1.src.rpm

i386:
mysql-5.0.95-1.el5_7.1.i386.rpm
mysql-bench-5.0.95-1.el5_7.1.i386.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.i386.rpm
mysql-devel-5.0.95-1.el5_7.1.i386.rpm
mysql-server-5.0.95-1.el5_7.1.i386.rpm
mysql-test-5.0.95-1.el5_7.1.i386.rpm

ia64:
mysql-5.0.95-1.el5_7.1.i386.rpm
mysql-5.0.95-1.el5_7.1.ia64.rpm
mysql-bench-5.0.95-1.el5_7.1.ia64.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.i386.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.ia64.rpm
mysql-devel-5.0.95-1.el5_7.1.ia64.rpm
mysql-server-5.0.95-1.el5_7.1.ia64.rpm
mysql-test-5.0.95-1.el5_7.1.ia64.rpm

ppc:
mysql-5.0.95-1.el5_7.1.ppc.rpm
mysql-5.0.95-1.el5_7.1.ppc64.rpm
mysql-bench-5.0.95-1.el5_7.1.ppc.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.ppc.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.ppc64.rpm
mysql-devel-5.0.95-1.el5_7.1.ppc.rpm
mysql-devel-5.0.95-1.el5_7.1.ppc64.rpm
mysql-server-5.0.95-1.el5_7.1.ppc.rpm
mysql-server-5.0.95-1.el5_7.1.ppc64.rpm
mysql-test-5.0.95-1.el5_7.1.ppc.rpm

s390x:
mysql-5.0.95-1.el5_7.1.s390.rpm
mysql-5.0.95-1.el5_7.1.s390x.rpm
mysql-bench-5.0.95-1.el5_7.1.s390x.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.s390.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.s390x.rpm
mysql-devel-5.0.95-1.el5_7.1.s390.rpm
mysql-devel-5.0.95-1.el5_7.1.s390x.rpm
mysql-server-5.0.95-1.el5_7.1.s390x.rpm
mysql-test-5.0.95-1.el5_7.1.s390x.rpm

x86_64:
mysql-5.0.95-1.el5_7.1.i386.rpm
mysql-5.0.95-1.el5_7.1.x86_64.rpm
mysql-bench-5.0.95-1.el5_7.1.x86_64.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.i386.rpm
mysql-debuginfo-5.0.95-1.el5_7.1.x86_64.rpm
mysql-devel-5.0.95-1.el5_7.1.i386.rpm
mysql-devel-5.0.95-1.el5_7.1.x86_64.rpm
mysql-server-5.0.95-1.el5_7.1.x86_64.rpm
mysql-test-5.0.95-1.el5_7.1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-0075.html
https://www.redhat.com/security/data/cve/CVE-2012-0087.html
https://www.redhat.com/security/data/cve/CVE-2012-0101.html
https://www.redhat.com/security/data/cve/CVE-2012-0102.html
https://www.redhat.com/security/data/cve/CVE-2012-0114.html
https://www.redhat.com/security/data/cve/CVE-2012-0484.html
https://www.redhat.com/security/data/cve/CVE-2012-0490.html
https://access.redhat.com/security/updates/classification/#moderate
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html
http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPOXTeXlSAg2UNWIIRAr2YAKCRLpwKgMfJlXZVnY0Q66 eLxYzo3QCdGraW
w6809/DA6haFduRlcOgldHU=
=xYMm
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list


All times are GMT. The time now is 08:51 AM.

VBulletin, Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.