mysql-5.1 - security update

2014-10-2200:00:00

Google

osv.dev

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

This update fixes one important vulnerability (CVE-2014-4274) and batches
together two other minor fixes (CVE-2013-2162, CVE-2014-0001).

CVE-2014-4274
Insecure handling of a temporary file that could lead to execution
of arbitrary code through the creation of a mysql configuration file
pointing to an attacker-controlled plugin_dir.
CVE-2013-2162
Insecure creation of the debian.cnf credential file. Credentials could
be stolen by a local user monitoring that file while the package gets
installed.
CVE-2014-0001
Buffer overrun in the MySQL client when the server sends a version
string that is too big for the allocated buffer.

For Debian 6 Squeeze, these issues have been fixed in mysql-5.1 version 5.1.73-1+deb6u1

CPENameOperatorVersion
mysql-5.1eq5.1.72-2
mysql-5.1eq5.1.56-1
mysql-5.1eq5.1.57-3
mysql-5.1eq5.1.57-3.1
mysql-5.1eq5.1.57-2
mysql-5.1eq5.1.54-1
mysql-5.1eq5.1.66-0+squeeze1
mysql-5.1eq5.1.63-0+squeeze1
mysql-5.1eq5.1.61-3
mysql-5.1eq5.1.73-1

Name	Operator	Version
mysql-5.1	eq	5.1.72-2
mysql-5.1	eq	5.1.56-1
mysql-5.1	eq	5.1.57-3
mysql-5.1	eq	5.1.57-3.1
mysql-5.1	eq	5.1.57-2
mysql-5.1	eq	5.1.54-1
mysql-5.1	eq	5.1.66-0+squeeze1
mysql-5.1	eq	5.1.63-0+squeeze1
mysql-5.1	eq	5.1.61-3
mysql-5.1	eq	5.1.73-1