Referenced CVEs:
CVE-2008-4098, CVE-2008-4456, CVE-2008-7247, CVE-2009-2446, CVE-2009-4019, CVE-2009-4030, CVE-2009-4484
Description:
===========================================================Ubuntu Security Notice USN-897-1 February 10, 2010mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilitiesCVE-2008-4098, CVE-2008-4456, CVE-2008-7247, CVE-2009-2446,CVE-2009-4019, CVE-2009-4030, CVE-2009-4484===========================================================A security issue affects the following Ubuntu releases:Ubuntu 6.06 LTSUbuntu 8.04 LTSUbuntu 8.10Ubuntu 9.04Ubuntu 9.10This advisory also applies to the corresponding versions ofKubuntu, Edubuntu, and Xubuntu.The problem can be corrected by upgrading your system to thefollowing package versions:Ubuntu 6.06 LTS: mysql-server-5.0 5.0.22-0ubuntu6.06.12Ubuntu 8.04 LTS: mysql-server-5.0 5.0.51a-3ubuntu5.5Ubuntu 8.10: mysql-server-5.0 5.0.67-0ubuntu6.1Ubuntu 9.04: mysql-server-5.0 5.1.30really5.0.75-0ubuntu10.3Ubuntu 9.10: mysql-server-5.1 5.1.37-1ubuntu5.1In general, a standard system upgrade is sufficient to effect thenecessary changes.Details follow:It was discovered that MySQL could be made to overwrite existing tablefiles in the data directory. An authenticated user could use the DATADIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks.This update alters table creation behaviour by disallowing the use of theMySQL data directory in DATA DIRECTORY and INDEX DIRECTORY options. Thisissue only affected Ubuntu 8.10. (CVE-2008-4098) It was discovered that MySQL contained a cross-site scripting vulnerabilityin the command-line client when the --html option is enabled. An attackercould place arbitrary web script or html in a database cell, which wouldthen get placed in the html document output by the command-line tool. Thisissue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04.(CVE-2008-4456)It was discovered that MySQL could be made to overwrite existing tablefiles in the data directory. An authenticated user could use symlinkscombined with the DATA DIRECTORY and INDEX DIRECTORY options to possiblybypass privilege checks. This issue only affected Ubuntu 9.10.(CVE-2008-7247)It was discovered that MySQL contained multiple format string flaws whenlogging database creation and deletion. An authenticated user could usespecially crafted database names to make MySQL crash, causing a denial ofservice. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04.(CVE-2009-2446)It was discovered that MySQL incorrectly handled errors when performingcertain SELECT statements, and did not preserve correct flags whenperforming statements that use the GeomFromWKB function. An authenticateduser could exploit this to make MySQL crash, causing a denial of service.(CVE-2009-4019)It was discovered that MySQL incorrectly checked symlinks when using theDATA DIRECTORY and INDEX DIRECTORY options. A local user could use symlinksto create tables that pointed to tables known to be created at a latertime, bypassing access restrictions. (CVE-2009-4030)It was discovered that MySQL contained a buffer overflow when parsingssl certificates. A remote attacker could send crafted requests and cause adenial of service or possibly execute arbitrary code. This issue did notaffect Ubuntu 6.06 LTS and the default compiler options for affectedreleases should reduce the vulnerability to a denial of service. In thedefault installation, attackers would also be isolated by the AppArmorMySQL profile. (CVE-2009-4484)
More...
