Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553.
The vioverifycallback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.
Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.
Buffer overflow in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to execute arbitrary code via a COMFIELDLIST command with a long table name.
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7247 to the following vulnerability:
sql/sqltable.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.
References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7247 http://lists.mysql.com/commits/59711 http://marc.info/?l=oss-security&m=125908040022018&w=2 http://bugs.mysql.com/bug.php?id=39277
Upstream patch: --------------- http://lists.mysql.com/commits/59711
The mynetskiprest function in sql/netserv.cc in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a large number of packets that exceed the maximum length.
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4030 to the following vulnerability:
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysqlunpackedrealdatahome value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
References: ----------- http://lists.mysql.com/commits/89940 http://www.openwall.com/lists/oss-security/2009/11/19/3 http://marc.info/?l=oss-security&m=125908040022018&w=2 http://www.openwall.com/lists/oss-security/2009/11/24/6 http://marc.info/?l=oss-security&m=125908080222685&w=2 http://bugs.mysql.com/bug.php?id=32167 http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html
Upstream patch: --------------- http://lists.mysql.com/commits/52326
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.19 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
MySQL 5.1.x before 5.1.63 and 5.5.x before 5.5.24 allows remote authenticated users to cause a denial of service (mysqld crash) via vectors related to incorrect calculation and a sort order index.
Multiple denial of service flaws were found in MySQL SQL database server. Quoting from upstream 5.0.88 release notes:
Error handling was missing for SELECT statements containing subqueries in the WHERE clause and that assigned a SELECT result to a user variable. The server could crash as a result. (Bug#48291)
If the first argument to GeomFromWKB() function was a geometry value, the function just returned its value. However, it failed to preserve the argument's nullvalue flag, which caused an unexpected NULL value to be returned to the caller, resulting in a server crash. (Bug#47780)
References: ----------- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html (there are more DoS issues mentioned in the release notes, but this CVE was assigned to these two)
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html http://bugs.mysql.com/47780 http://bugs.mysql.com/48291
Upstream patches: ----------------- For Bug #48291 crash with row() operator,select into @var, and subquery returning multiple rows: http://lists.mysql.com/commits/88409 http://lists.mysql.com/commits/88741
For Bug #47780: crash when comparing GIS items from subquery: http://lists.mysql.com/commits/87591 http://lists.mysql.com/commits/88069
sql/itemxmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion failure.
A denial of service flaw was found in the way MySQL processed EXPLAIN statements for SQL queries of the form:
SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)
A remote authenticated MySQL user could use this flaw to cause mysqld deamon crash (dereference NULL pointer).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=52711
Upstream changesets: [4] http://lists.mysql.com/commits/105750 [5] http://lists.mysql.com/commits/112043
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.
A denial of service flaw was found in the way MySQL processed alternate read requests from two indexes on a table using the HANDLER interface. A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort.
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54007
Upstream commit: [4] http://lists.mysql.com/commits/110598
A denial of service flaw was found in the way MySQL processed multiple parallel connections changing InnoDB storage engine configuration parameters (innodbfileformat and innodbfilepertable) and simultaneously issuing data definition language (DDL) statemens. A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=55039
A denial of service flaw was found in the way MySQL processed SQL queries containing IN or CASE statements, when NULL argument was provided as one of the arguments to the query. A remote MySQL user could use this flaw to cause myqld daemon crash (dereference a NULL pointer).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54477
Upstream changeset: [4] http://lists.mysql.com/commits/111814
MySQL improperly handled LOAD DATA INFILE requests (it did not check for SQL errors and sent an OK packet even when errors were already reported). A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=52512
Upstream changeset: [4] http://lists.mysql.com/commits/105163
A use of unassigned memory was found in the way MySQL processed certain values provided to the BINLOG statement. A remote attacker could use this flaw to cause denial of service (mysqld daemon crash) in some cases.
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54393
Upstream changeset: [4] http://lists.mysql.com/commits/111591
Note: The impact of this flaw is further mitigated by the requirement only privileged user can run the BINLOG statement.
A denial of service flaw was found in the way MySQL processed joins queries, which involved a table with unique SET column. A remote MySQL user could use this flaw to cause mysqld daemon crash.
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54575
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.
A denial of service was found in the way MySQL processed creation of temporary tables, when the InnoDB storage engine was used. A remote authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54044
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the abort.
MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.