REDHAT-BUG-540906

First published: Tue Nov 24 2009(Updated: )

Multiple denial of service flaws were found in MySQL SQL database server. Quoting from upstream 5.0.88 release notes: * Error handling was missing for SELECT statements containing subqueries in the WHERE clause and that assigned a SELECT result to a user variable. The server could crash as a result. (Bug#48291) * If the first argument to GeomFromWKB() function was a geometry value, the function just returned its value. However, it failed to preserve the argument's null_value flag, which caused an unexpected NULL value to be returned to the caller, resulting in a server crash. (<a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED RAWHIDE - ipv6 patch" href="show_bug.cgi?id=47780">Bug#47780</a>) References: ----------- <a href="http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html">http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html</a> (there are more DoS issues mentioned in the release notes, but this CVE was assigned to these two) <a href="http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html">http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html</a> <a href="http://bugs.mysql.com/47780">http://bugs.mysql.com/47780</a> <a href="http://bugs.mysql.com/48291">http://bugs.mysql.com/48291</a> Upstream patches: ----------------- * For Bug #48291 crash with row() operator,select into @var, and subquery returning multiple rows: <a href="http://lists.mysql.com/commits/88409">http://lists.mysql.com/commits/88409</a> <a href="http://lists.mysql.com/commits/88741">http://lists.mysql.com/commits/88741</a> * For <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED RAWHIDE - ipv6 patch" href="show_bug.cgi?id=47780">Bug #47780</a>: crash when comparing GIS items from subquery: <a href="http://lists.mysql.com/commits/87591">http://lists.mysql.com/commits/87591</a> <a href="http://lists.mysql.com/commits/88069">http://lists.mysql.com/commits/88069</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• agent/last-modified-date
• agent/first-publish-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2009-4019
• agent/severity
• agent/references
• agent/description
• agent/event
• agent/source
• agent/softwarecombine
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/mysql
• canonical/mysql (mysql-common)