Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Solaris system is missing necessary patches to address security updates :

  - MySQL before 5.0.67 allows local users to bypass certain     privilege checks by calling CREATE TABLE on a MyISAM     table with modified (1) DATA DIRECTORY or (2) INDEX     DIRECTORY arguments that are originally associated with     pathnames without symlinks, and that can point to tables     created at a future time at which a pathname is modified     to contain a symlink to a subdirectory of the MySQL home     data directory. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2008-4097. (CVE-2008-4098)

  - sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x     through 5.1.41, and 6.0 before 6.0.9-alpha, when the     data home directory contains a symlink to a different     filesystem, allows remote authenticated users to bypass     intended access restrictions by calling CREATE TABLE     with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY     argument referring to a subdirectory that requires     following this symlink. (CVE-2008-7247)

  - MySQL before 5.1.46 allows local users to delete the     data and index files of another user's MyISAM table via     a symlink attack in conjunction with the DROP TABLE     command, a different vulnerability than CVE-2008-4098     and CVE-2008-7247. (CVE-2010-1626)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x     before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL     5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and     earlier allows remote attackers to cause a denial of     service (crash) via a crafted geometry feature that     specifies a large number of points, which is not     properly handled when processing the binary     representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

Add backported patch for CVE-2008-7247 Use non-expired certificates for SSL testing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated MySQL packages fix the following bugs :

  - upstream #47320 - checking server certificates.
    (CVE-2009-4028)

  - upstream #48291 - error handling in subqueries.
    (CVE-2009-4019)

  - upstream #47780 - preserving null_value flag in     GeomFromWKB(). (CVE-2009-4019)

  - upstream #39277 - symlink behaviour fixed.
    (CVE-2008-7247)

  - upstream #32167 - symlink behaviour refixed     (CVE-2009-4030)

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

Updated mysql packages fix the following bugs :

  - upstream #47320 - checking server certificates     (CVE-2009-4028)

  - upstream #48291 - error handling in subqueries     (CVE-2009-4019)

  - upstream #47780 - preserving null_value flag in     GeomFromWKB() (CVE-2009-4019)

  - upstream #39277 - symlink behaviour fixed     (CVE-2008-7247)

  - upstream #32167 - symlink behaviour refixed     (CVE-2009-4030)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	2012/3/13	2019/9/19	high
80705	Oracle Solaris Third-Party Patch Update : mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
47248	Fedora 12 : mysql-5.1.42-7.fc12 (2010-1348)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
50935	SuSE 11 Security Update : MySQL (SAT Patch Number 2317)	Nessus	SuSE Local Security Checks	2010/12/2	2021/1/14	medium
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical
46232	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	2010/5/5	2021/1/14	medium
46229	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	2010/5/5	2021/1/14	medium

检测

插件搜索

high

medium

medium

medium

critical

medium

medium