The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0164 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of     the MySQL server daemon (mysqld) and many client programs and libraries.

    The MySQL PolyFromWKB() function did not sanity check Well-Known Binary     (WKB) data, which could allow a remote, authenticated attacker to crash     mysqld. (CVE-2010-3840)

    A flaw in the way MySQL processed certain JOIN queries could allow a     remote, authenticated attacker to cause excessive CPU use (up to 100%), if     a stored procedure contained JOIN queries, and that procedure was executed     twice in sequence. (CVE-2010-3839)

    A flaw in the way MySQL processed queries that provide a mixture of numeric     and longblob data types to the LEAST or GREATEST function, could allow a     remote, authenticated attacker to crash mysqld. (CVE-2010-3838)

    A flaw in the way MySQL processed PREPARE statements containing both     GROUP_CONCAT and the WITH ROLLUP modifier could allow a remote,     authenticated attacker to crash mysqld. (CVE-2010-3837)

    MySQL did not properly pre-evaluate LIKE arguments in view prepare mode,     possibly allowing a remote, authenticated attacker to crash mysqld.
    (CVE-2010-3836)

    A flaw in the way MySQL processed statements that assign a value to a     user-defined variable and that also contain a logical value evaluation     could allow a remote, authenticated attacker to crash mysqld.
    (CVE-2010-3835)

    A flaw in the way MySQL evaluated the arguments of extreme-value functions,     such as LEAST and GREATEST, could allow a remote, authenticated attacker to     crash mysqld. (CVE-2010-3833)

    A flaw in the way MySQL handled LOAD DATA INFILE requests allowed MySQL to     send OK packets even when there were errors. (CVE-2010-3683)

    A flaw in the way MySQL processed EXPLAIN statements for some complex     SELECT queries could allow a remote, authenticated attacker to crash     mysqld. (CVE-2010-3682)

    A flaw in the way MySQL processed certain alternating READ requests     provided by HANDLER statements could allow a remote, authenticated attacker     to crash mysqld. (CVE-2010-3681)

    A flaw in the way MySQL processed CREATE TEMPORARY TABLE statements that     define NULL columns when using the InnoDB storage engine, could allow a     remote, authenticated attacker to crash mysqld. (CVE-2010-3680)

    A flaw in the way MySQL processed certain values provided to the BINLOG     statement caused MySQL to read unassigned memory. A remote, authenticated     attacker could possibly use this flaw to crash mysqld. (CVE-2010-3679)

    A flaw in the way MySQL processed SQL queries containing IN or CASE     statements, when a NULL argument was provided as one of the arguments to     the query, could allow a remote, authenticated attacker to crash mysqld.
    (CVE-2010-3678)

    A flaw in the way MySQL processed JOIN queries that attempt to retrieve     data from a unique SET column could allow a remote, authenticated attacker     to crash mysqld. (CVE-2010-3677)

    Note: CVE-2010-3840, CVE-2010-3838, CVE-2010-3837, CVE-2010-3835,     CVE-2010-3833, CVE-2010-3682, CVE-2010-3681, CVE-2010-3680, CVE-2010-3678,     and CVE-2010-3677 only cause a temporary denial of service, as mysqld was     automatically restarted after each crash.

    These updated packages upgrade MySQL to version 5.1.52. Refer to the MySQL     release notes for a full list of changes:

    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html

    All MySQL users should upgrade to these updated packages, which correct     these issues. After installing this update, the MySQL server daemon     (mysqld) will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0825 advisory.

    - Add fixes for CVE-2010-3677, CVE-2010-3680, CVE-2010-3681, CVE-2010-3682,       CVE-2010-3833, CVE-2010-3835, CVE-2010-3836, CVE-2010-3837, CVE-2010-3838,       CVE-2010-3839, CVE-2010-3840     Resolves: #645642

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0164 advisory.

    [5.1.52-1.1]
    - Update to MySQL 5.1.52, for various fixes described at       http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html       including numerous small security issues     Resolves: #652553
    - Sync with current Fedora package; this includes:
    - Duplicate COPYING and EXCEPTIONS-CLIENT in -libs and -embedded subpackages,       to ensure they are available when any subset of mysql RPMs are installed,       per revised packaging guidelines
    - Allow init script's STARTTIMEOUT/STOPTIMEOUT to be overridden from sysconfig

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in mysql :

MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory (CVE-2010-2008).

Additionally many security issues noted in the 5.1.49 release notes has been addressed with this advisory as well, such as :

  - LOAD DATA INFILE did not check for SQL errors and sent     an OK packet even when errors were already reported.
    Also, an assert related to client-server protocol     checking in debug servers sometimes was raised when it     should not have been. (Bug#52512) (CVE-2010-3683)

  - Using EXPLAIN with queries of the form SELECT ... UNION     ... ORDER BY (SELECT ... WHERE ...) could cause a server     crash. (Bug#52711) (CVE-2010-3682)

  - The server could crash if there were alternate reads     from two indexes on a table using the HANDLER interface.
    (Bug#54007) (CVE-2010-3681)

  - A malformed argument to the BINLOG statement could     result in Valgrind warnings or a server crash.
    (Bug#54393) (CVE-2010-3679)

  - Incorrect handling of NULL arguments could lead to a     crash for IN() or CASE operations when NULL arguments     were either passed explicitly as arguments (for IN()) or     implicitly generated by the WITH ROLLUP modifier (for     IN() and CASE). (Bug#54477) (CVE-2010-3678)

  - Joins involving a table with with a unique SET column     could cause a server crash. (Bug#54575) (CVE-2010-3677)

  - Use of TEMPORARY InnoDB tables with nullable columns     could cause a server crash. (Bug#54044) (CVE-2010-3680)

The updated packages have been patched to correct these issues.

Update :

Packages for 2009.1 was not provided with the MDVSA-2010:155 advisory.
This advisory provides the missing packages.

The MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data, which could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3840)

A flaw in the way MySQL processed certain JOIN queries could allow a remote, authenticated attacker to cause excessive CPU use (up to 100%), if a stored procedure contained JOIN queries, and that procedure was executed twice in sequence. (CVE-2010-3839)

A flaw in the way MySQL processed queries that provide a mixture of numeric and longblob data types to the LEAST or GREATEST function, could allow a remote, authenticated attacker to crash mysqld.
(CVE-2010-3838)

A flaw in the way MySQL processed PREPARE statements containing both GROUP_CONCAT and the WITH ROLLUP modifier could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3837)

MySQL did not properly pre-evaluate LIKE arguments in view prepare mode, possibly allowing a remote, authenticated attacker to crash mysqld. (CVE-2010-3836)

A flaw in the way MySQL processed statements that assign a value to a user-defined variable and that also contain a logical value evaluation could allow a remote, authenticated attacker to crash mysqld.
(CVE-2010-3835)

A flaw in the way MySQL evaluated the arguments of extreme-value functions, such as LEAST and GREATEST, could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3833)

A flaw in the way MySQL handled LOAD DATA INFILE requests allowed MySQL to send OK packets even when there were errors. (CVE-2010-3683)

A flaw in the way MySQL processed EXPLAIN statements for some complex SELECT queries could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3682)

A flaw in the way MySQL processed certain alternating READ requests provided by HANDLER statements could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3681)

A flaw in the way MySQL processed CREATE TEMPORARY TABLE statements that define NULL columns when using the InnoDB storage engine, could allow a remote, authenticated attacker to crash mysqld.
(CVE-2010-3680)

A flaw in the way MySQL processed certain values provided to the BINLOG statement caused MySQL to read unassigned memory. A remote, authenticated attacker could possibly use this flaw to crash mysqld.
(CVE-2010-3679)

A flaw in the way MySQL processed SQL queries containing IN or CASE statements, when a NULL argument was provided as one of the arguments to the query, could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3678)

A flaw in the way MySQL processed JOIN queries that attempt to retrieve data from a unique SET column could allow a remote, authenticated attacker to crash mysqld. (CVE-2010-3677)

Note: CVE-2010-3840, CVE-2010-3838, CVE-2010-3837, CVE-2010-3835, CVE-2010-3833, CVE-2010-3682, CVE-2010-3681, CVE-2010-3680, CVE-2010-3678, and CVE-2010-3677 only cause a temporary denial of service, as mysqld was automatically restarted after each crash.

These updated packages upgrade MySQL to version 5.1.52. Refer to the MySQL release notes for a full list of changes :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

Updated mysql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.

It was found that the MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data. A remote, authenticated attacker could use specially crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain JOIN queries. If a stored procedure contained JOIN queries, and that procedure was executed twice in sequence, it could cause an infinite loop, leading to excessive CPU use (up to 100%). A remote, authenticated attacker could use this flaw to cause a denial of service. (CVE-2010-3839)

A flaw was found in the way MySQL processed queries that provide a mixture of numeric and longblob data types to the LEAST or GREATEST function. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3838)

A flaw was found in the way MySQL processed PREPARE statements containing both GROUP_CONCAT and the WITH ROLLUP modifier. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3837)

It was found that MySQL did not properly pre-evaluate LIKE arguments in view prepare mode. A remote, authenticated attacker could possibly use this flaw to crash mysqld. (CVE-2010-3836)

A flaw was found in the way MySQL processed statements that assign a value to a user-defined variable and that also contain a logical value evaluation. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3835)

A flaw was found in the way MySQL evaluated the arguments of extreme-value functions, such as LEAST and GREATEST. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3833)

A flaw was found in the way MySQL processed EXPLAIN statements for some complex SELECT queries. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3682)

A flaw was found in the way MySQL processed certain alternating READ requests provided by HANDLER statements. A remote, authenticated attacker could use this flaw to provide such requests, causing mysqld to crash. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3681)

A flaw was found in the way MySQL processed CREATE TEMPORARY TABLE statements that define NULL columns when using the InnoDB storage engine. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3680)

A flaw was found in the way MySQL processed JOIN queries that attempt to retrieve data from a unique SET column. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3677)

All MySQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

Several vulnerabilities have been discovered in the MySQL database server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-3677     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     via a join query that uses a table with a unique SET     column.

  - CVE-2010-3680     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by creating temporary tables while using InnoDB, which     triggers an assertion failure.

  - CVE-2010-3681     It was discovered that MySQL allows remote authenticated     users to cause a denial of service (mysqld daemon crash)     by using the HANDLER interface and performing 'alternate     reads from two indexes on a table,' which triggers an     assertion failure.

  - CVE-2010-3682     It was discovered that MySQL incorrectly handled use of     EXPLAIN with certain queries. An authenticated user     could crash the server.

  - CVE-2010-3833     It was discovered that MySQL incorrectly handled     propagation during evaluation of arguments to     extreme-value functions. An authenticated user could     crash the server.

  - CVE-2010-3834     It was discovered that MySQL incorrectly handled     materializing a derived table that required a temporary     table for grouping. An authenticated user could crash     the server.

  - CVE-2010-3835     It was discovered that MySQL incorrectly handled certain     user-variable assignment expressions that are evaluated     in a logical expression context. An authenticated user     could crash the server.

  - CVE-2010-3836     It was discovered that MySQL incorrectly handled     pre-evaluation of LIKE predicates during view     preparation. An authenticated user could crash the     server.

  - CVE-2010-3837     It was discovered that MySQL incorrectly handled using     GROUP_CONCAT() and WITH ROLLUP together. An     authenticated user could crash the server.

  - CVE-2010-3838     It was discovered that MySQL incorrectly handled certain     queries using a mixed list of numeric and LONGBLOB     arguments to the GREATEST() or LEAST() functions. An     authenticated user could crash the server.

  - CVE-2010-3840     It was discovered that MySQL incorrectly handled     improper WKB data passed to the PolyFromWKB() function.
    An authenticated user could crash the server.

Multiple vulnerabilities has been found and corrected in mysql :

storage/innobase/dict/dict0crea.c in mysqld in MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodb_file_format or (2) innodb_file_per_table configuration parameters for the InnoDB storage engine, then executing a DDL statement (CVE-2010-3676).

MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column (CVE-2010-3677).

MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier (CVE-2010-3678).

MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via certain arguments to the BINLOG command, which triggers an access of uninitialized memory, as demonstrated by valgrind (CVE-2010-3679).

MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by creating temporary tables while using InnoDB, which triggers an assertion failure (CVE-2010-3680).

MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using the HANDLER interface and performing alternate reads from two indexes on a table, which triggers an assertion failure (CVE-2010-3681).

MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted 'SELECT ... UNION ... ORDER BY \(SELECT ... WHERE ...\)' statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store function (CVE-2010-3682).

MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request generates SQL errors, which allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a crafted request (CVE-2010-3683).

The updated packages have been upgraded to the latest (last) stable 5.1 release (5.1.54) to address these issues for both Mandriva Linux 2010.0 and 2010.2.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-485:04 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation     consisting of a server daemon (mysqld) and many different client programs and libraries. The base package     contains the MySQL client programs, the client shared libraries, and generic MySQL files.
    Security issues fixed with this release:
    CVE-2010-3677     CVE-2010-3680     CVE-2010-3681     CVE-2010-3682     CVE-2010-3833     CVE-2010-3835     CVE-2010-3836     CVE-2010-3837     CVE-2010-3838     CVE-2010-3839     CVE-2010-3840     No information available at the time of writing, please see the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues.

MySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to MySQL 5.0.95.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information :

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.ht ml.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that the MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data. A remote, authenticated attacker could use specially crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3840)

A flaw was found in the way MySQL processed certain JOIN queries. If a stored procedure contained JOIN queries, and that procedure was executed twice in sequence, it could cause an infinite loop, leading to excessive CPU use (up to 100%). A remote, authenticated attacker could use this flaw to cause a denial of service. (CVE-2010-3839)

A flaw was found in the way MySQL processed queries that provide a mixture of numeric and longblob data types to the LEAST or GREATEST function. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3838)

A flaw was found in the way MySQL processed PREPARE statements containing both GROUP_CONCAT and the WITH ROLLUP modifier. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3837)

It was found that MySQL did not properly pre-evaluate LIKE arguments in view prepare mode. A remote, authenticated attacker could possibly use this flaw to crash mysqld. (CVE-2010-3836)

A flaw was found in the way MySQL processed statements that assign a value to a user-defined variable and that also contain a logical value evaluation. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3835)

A flaw was found in the way MySQL evaluated the arguments of extreme-value functions, such as LEAST and GREATEST. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3833)

A flaw was found in the way MySQL processed EXPLAIN statements for some complex SELECT queries. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3682)

A flaw was found in the way MySQL processed certain alternating READ requests provided by HANDLER statements. A remote, authenticated attacker could use this flaw to provide such requests, causing mysqld to crash. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3681)

A flaw was found in the way MySQL processed CREATE TEMPORARY TABLE statements that define NULL columns when using the InnoDB storage engine. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3680)

A flaw was found in the way MySQL processed JOIN queries that attempt to retrieve data from a unique SET column. A remote, authenticated attacker could use this flaw to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3677)

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-32:01 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation     consisting of a server daemon (mysqld) and many different client programs and libraries. The base package     contains the MySQL client programs, the client shared libraries, and generic MySQL files.
    Security issues fixed with this release:
    CVE-2010-3677     Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial     of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.
    CVE-2010-3678     Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via     (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by     the WITH ROLLUP modifier.
    CVE-2010-3679     Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld     daemon crash) via certain arguments to the BINLOG command, which triggers an access of uninitialized     memory, as demonstrated by valgrind.
    CVE-2010-3680     Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld     daemon crash) by creating temporary tables with nullable columns while using InnoDB, which triggers an     assertion failure.
    CVE-2010-3681     Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of     service (mysqld daemon crash) by using the HANDLER interface and performing 'alternate reads from two     indexes on a table,' which triggers an assertion failure.
    CVE-2010-3682     Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial     of service (mysqld daemon crash) by using EXPLAIN with crafted 'SELECT ... UNION ... ORDER BY (SELECT ...
    WHERE ...)' statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store     function.
    CVE-2010-3683     Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request     generates SQL errors, which allows remote authenticated users to cause a denial of service (mysqld daemon     crash) via a crafted request.
    CVE-2010-3833     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 does not properly propagate type errors,     which allows remote attackers to cause a denial of service (server crash) via crafted arguments to     extreme-value functions such as (1) LEAST and (2) GREATEST, related to KILL_BAD_DATA and a 'CREATE TABLE     ... SELECT.'     CVE-2010-3835     MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of     service (mysqld server crash) by performing a user-variable assignment in a logical expression that is     calculated and stored in a temporary table for GROUP BY, then causing the expression value to be used     after the table is created, which causes the expression to be re-evaluated instead of accessing its value     from the table.
    CVE-2010-3836     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to     cause a denial of service (assertion failure and server crash) via vectors related to view preparation,     pre-evaluation of LIKE predicates, and IN Optimizers.
    CVE-2010-3837     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to     cause a denial of service (server crash) via a prepared statement that uses GROUP_CONCAT with the WITH     ROLLUP modifier, probably triggering a use-after-free error when a copied object is modified in a way that     also affects the original object.
    CVE-2010-3838     MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to     cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with     a mixed list of numeric and LONGBLOB arguments, which is not properly handled when the function's result     is 'processed using an intermediate temporary table.'     CVE-2010-3839     MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of     service (infinite loop) via multiple invocations of a (1) prepared statement or (2) stored procedure that     creates a query with nested JOIN statements.
    CVE-2010-3840     The Gis_line_string::init_from_wkb function in sql/spatial.cc in MySQL 5.1 before 5.1.51 allows remote     authenticated users to cause a denial of service (server crash) by calling the PolyFromWKB function with     Well-Known Binary (WKB) data containing a crafted number of (1) line strings or (2) line points.
    These updated packages upgrade MySQL to version 5.1.52. Refer to the MySQL release notes for a full list     of changes:
    <A HREF=http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html>http://dev.mysql...

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- local users could delete data files for tables of other     users (CVE-2010-1626).

  - authenticated users could gather information for tables     they should not have access to (CVE-2010-1849)

  - authenticated users could crash mysqld (CVE-2010-1848)

  - authenticated users could potentially execute arbitrary     code as the user running mysqld (CVE-2010-1850)

  - authenticated users could crash mysqld (CVE-2010-3676,     CVE-2010-3677, CVE-2010-3678, CVE-2010-3679,     CVE-2010-3680, CVE-2010-3681, CVE-2010-3682,     CVE-2010-3683, CVE-2010-2008)

  - a race condition in /etc/init.d/mysql allowed local     users to make any file readable via symlink in /var/tmp     (CVE-2010-3675)

It was discovered that MySQL incorrectly handled certain requests with the UPGRADE DATA DIRECTORY NAME command. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-2008)

It was discovered that MySQL incorrectly handled joins involving a table with a unique SET column. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS.
(CVE-2010-3677)

It was discovered that MySQL incorrectly handled NULL arguments to IN() or CASE operations. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-3678)

It was discovered that MySQL incorrectly handled malformed arguments to the BINLOG statement. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-3679)

It was discovered that MySQL incorrectly handled the use of TEMPORARY InnoDB tables with nullable columns. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS.
(CVE-2010-3680)

It was discovered that MySQL incorrectly handled alternate reads from two indexes on a table using the HANDLER interface. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-3681)

It was discovered that MySQL incorrectly handled use of EXPLAIN with certain queries. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-3682)

It was discovered that MySQL incorrectly handled error reporting when using LOAD DATA INFILE and would incorrectly raise an assert in certain circumstances. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. (CVE-2010-3683)

It was discovered that MySQL incorrectly handled propagation during evaluation of arguments to extreme-value functions. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10, 10.04 LTS and 10.10. (CVE-2010-3833)

It was discovered that MySQL incorrectly handled materializing a derived table that required a temporary table for grouping. An authenticated user could exploit this to make MySQL crash, causing a denial of service. (CVE-2010-3834)

It was discovered that MySQL incorrectly handled certain user-variable assignment expressions that are evaluated in a logical expression context. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10, 10.04 LTS and 10.10. (CVE-2010-3835)

It was discovered that MySQL incorrectly handled pre-evaluation of LIKE predicates during view preparation. An authenticated user could exploit this to make MySQL crash, causing a denial of service.
(CVE-2010-3836)

It was discovered that MySQL incorrectly handled using GROUP_CONCAT() and WITH ROLLUP together. An authenticated user could exploit this to make MySQL crash, causing a denial of service. (CVE-2010-3837)

It was discovered that MySQL incorrectly handled certain queries using a mixed list of numeric and LONGBLOB arguments to the GREATEST() or LEAST() functions. An authenticated user could exploit this to make MySQL crash, causing a denial of service. (CVE-2010-3838)

It was discovered that MySQL incorrectly handled queries with nested joins when used from stored procedures and prepared statements. An authenticated user could exploit this to make MySQL hang, causing a denial of service. This issue only affected Ubuntu 9.10, 10.04 LTS and 10.10. (CVE-2010-3839)

It was discovered that MySQL incorrectly handled improper WKB data passed to the PolyFromWKB() function. An authenticated user could exploit this to make MySQL crash, causing a denial of service.
(CVE-2010-3840).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
51571	RHEL 6 : mysql (RHSA-2011:0164)	Nessus	Red Hat Local Security Checks	2011/1/19	2025/4/14	medium
68134	Oracle Linux 5 : mysql (ELSA-2010-0825)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/23	medium
68184	Oracle Linux 6 : mysql (ELSA-2011-0164)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
48399	Mandriva Linux Security Advisory : mysql (MDVSA-2010:155-1)	Nessus	Mandriva Local Security Checks	2010/8/23	2021/1/6	medium
60940	Scientific Linux Security Update : mysql on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
50806	CentOS 5 : mysql (CESA-2010:0825)	Nessus	CentOS Local Security Checks	2010/11/24	2021/1/4	medium
51530	Debian DSA-2143-1 : mysql-dfsg-5.0 - several vulnerabilities	Nessus	Debian Local Security Checks	2011/1/17	2021/1/4	medium
51804	Mandriva Linux Security Advisory : mysql (MDVSA-2011:012)	Nessus	Mandriva Local Security Checks	2011/1/28	2021/1/6	medium
283959	MiracleLinux 3 : mysql-5.0.77-4.4.0.1.AXS3 (AXSA:2010-485:04)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
58325	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)	Nessus	Ubuntu Local Security Checks	2012/3/13	2019/9/19	high
60884	Scientific Linux Security Update : mysql on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
284205	MiracleLinux 4 : mysql-5.1.52-1.AXS4.1 (AXSA:2011-32:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
50016	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0730-1)	Nessus	SuSE Local Security Checks	2010/10/18	2021/1/14	medium
50474	RHEL 5 : mysql (RHSA-2010:0825)	Nessus	Red Hat Local Security Checks	2010/11/4	2021/1/14	medium
50573	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1017-1)	Nessus	Ubuntu Local Security Checks	2010/11/12	2019/9/19	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium