A denial of service flaw was found in the way MySQL processed EXPLAIN statements for SQL queries of the form:

SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)

A remote authenticated MySQL user could use this flaw to cause mysqld deamon crash (dereference NULL pointer).

References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html

Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=52711

Upstream changesets: [4] http://lists.mysql.com/commits/105750 [5] http://lists.mysql.com/commits/112043

Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.

A denial of service flaw was found in the way MySQL processed joins queries, which involved a table with unique SET column. A remote MySQL user could use this flaw to cause mysqld daemon crash.

References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html

Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54575

Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.

Buffer overflow in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to execute arbitrary code via a COMFIELDLIST command with a long table name.

Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.

The mynetskiprest function in sql/netserv.cc in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a large number of packets that exceed the maximum length.

MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.