Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553.
Multiple SQL injection flaws were found in the way the binlog functionality (routines producing events describing database changes such as table creation operations or changes to table data) of MySQL, a multi-user, multi-threaded SQL database server, performed sanitization of table names and other fields prior creating particular log entry. Authorised database users (with privilege to modify tables) could use this flaw to inject arbitrary SQL query into subsequently generated binlog entries.
References: [1] https://mariadb.atlassian.net/browse/MDEV-382
MariaDB patches: [2] http://bazaar.launchpad.net/~maria-captains/maria/5.1/revision/3151.1.1 (against 5.1 branch) [3] http://bazaar.launchpad.net/~maria-captains/maria/5.2/revision/3163.1.1 (against 5.2 branch) [4] http://bazaar.launchpad.net/~maria-captains/maria/5.3/revision/3556.1.2 (against 5.3 branch) [5] http://bazaar.launchpad.net/~maria-captains/maria/5.5/revision/3508 (against 5.5 branch)
MySQL bug: [6] http://bugs.mysql.com/66550
MySQL version 5.5.23 releases notes mention following security fix:
Security Fix: Bug #59533 was fixed.
http://dev.mysql.com/doc/refman/5.5/en/news-5-5-23.html
Upstream bug is currently private and there's no additional info currently available for this issue. The bug is not referenced by any commit in the upstream bazaar repositories.
http://bugs.mysql.com/bug.php?id=59533
MySQL 5.1.x before 5.1.63 and 5.5.x before 5.5.24 allows remote authenticated users to cause a denial of service (mysqld crash) via vectors related to incorrect calculation and a sort order index.
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.19 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
MySQL improperly handled LOAD DATA INFILE requests (it did not check for SQL errors and sent an OK packet even when errors were already reported). A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=52512
Upstream changeset: [4] http://lists.mysql.com/commits/105163
A denial of service flaw was found in the way MySQL processed alternate read requests from two indexes on a table using the HANDLER interface. A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort.
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54007
Upstream commit: [4] http://lists.mysql.com/commits/110598
A denial of service flaw was found in the way MySQL processed alternate read requests from two indexes on a table using the HANDLER interface. A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort.
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54007
Upstream commit: [4] http://lists.mysql.com/commits/110598
A denial of service flaw was found in the way MySQL processed multiple parallel connections changing InnoDB storage engine configuration parameters (innodbfileformat and innodbfilepertable) and simultaneously issuing data definition language (DDL) statemens. A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=55039
A denial of service flaw was found in the way MySQL processed multiple parallel connections changing InnoDB storage engine configuration parameters (innodbfileformat and innodbfilepertable) and simultaneously issuing data definition language (DDL) statemens. A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=55039
A denial of service flaw was found in the way MySQL processed EXPLAIN statements for SQL queries of the form:
SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)
A remote authenticated MySQL user could use this flaw to cause mysqld deamon crash (dereference NULL pointer).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=52711
Upstream changesets: [4] http://lists.mysql.com/commits/105750 [5] http://lists.mysql.com/commits/112043
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.
A denial of service was found in the way MySQL processed creation of temporary tables, when the InnoDB storage engine was used. A remote authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54044
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the abort.
A denial of service was found in the way MySQL processed creation of temporary tables, when the InnoDB storage engine was used. A remote authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54044
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the abort.
A denial of service flaw was found in the way MySQL processed SQL queries containing IN or CASE statements, when NULL argument was provided as one of the arguments to the query. A remote MySQL user could use this flaw to cause myqld daemon crash (dereference a NULL pointer).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54477
Upstream changeset: [4] http://lists.mysql.com/commits/111814
A denial of service flaw was found in the way MySQL processed SQL queries containing IN or CASE statements, when NULL argument was provided as one of the arguments to the query. A remote MySQL user could use this flaw to cause myqld daemon crash (dereference a NULL pointer).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54477
Upstream changeset: [4] http://lists.mysql.com/commits/111814
A use of unassigned memory was found in the way MySQL processed certain values provided to the BINLOG statement. A remote attacker could use this flaw to cause denial of service (mysqld daemon crash) in some cases.
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54393
Upstream changeset: [4] http://lists.mysql.com/commits/111591
Note: The impact of this flaw is further mitigated by the requirement only privileged user can run the BINLOG statement.
A denial of service flaw was found in the way MySQL processed joins queries, which involved a table with unique SET column. A remote MySQL user could use this flaw to cause mysqld daemon crash.
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54575
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.
A denial of service flaw was found in the way MySQL processed joins queries, which involved a table with unique SET column. A remote MySQL user could use this flaw to cause mysqld daemon crash.
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=54575
Note: This issue only causes a temporary denial of service, as the mysql daemon shipped with Red Hat Enterprise Linux 5 will be automatically restarted after the crash.
MySQL improperly handled LOAD DATA INFILE requests (it did not check for SQL errors and sent an OK packet even when errors were already reported). A remote, authenticated MySQL user could use this flaw to cause mysqld daemon abort (assertion failure).
References: [1] http://secunia.com/advisories/41048/ [2] http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
Upstream bug report: [3] http://bugs.mysql.com/bug.php?id=52512
Upstream changeset: [4] http://lists.mysql.com/commits/105163
Buffer overflow in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to execute arbitrary code via a COMFIELDLIST command with a long table name.
Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.
The mynetskiprest function in sql/netserv.cc in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a large number of packets that exceed the maximum length.
MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.
The mysqluninstallplugin function in sql/sqlplugin.cc in MySQL 5.1 before 5.1.46 does not check privileges before uninstalling a plugin, which allows remote attackers to uninstall arbitrary plugins via the UNINSTALL PLUGIN command.
sql/itemxmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion failure.
The federated engine in MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4, when performing a certain SHOW TABLE STATUS query, allows remote MySQL servers to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns.
MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.
The convertsearchmodetoinnobase function in hainnodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows remote authenticated users to cause a denial of service (database crash) via a certain CONTAINS operation on an indexed column, which triggers an assertion error.
The mysqlchangedb function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::dbaccess privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.
MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.