lp://staging/ubuntu/dapper-updates/mysql-dfsg-5.0

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

22. By Marc Deslauriers on 2010-11-09

* SECURITY UPDATE: denial of service via joins involving a table with a
  unique SET column
  - debian/patches/113_SECURITY_CVE-2010-3677.dpatch: improve logic in
    sql/item_cmpfunc.cc. Add tests to mysql-test/*.
  - CVE-2010-3677
* SECURITY UPDATE: denial of service via TEMPORARY InnoDB tables with
  nullable columns
  - debian/patches/113_SECURITY_CVE-2010-3680.dpatch: check for null
    datatype in sql/ha_innodb.cc. Add tests to mysql-test/*.
  - CVE-2010-3680
* SECURITY UPDATE: denial of service via alternate reads from two indexes
  on a table using the HANDLER interface
  - debian/patches/113_SECURITY_CVE-2010-3681.dpatch: check for the same
    index in sql/sql_handler.cc. Add tests to mysql-test/*.
  - CVE-2010-3681
* SECURITY UPDATE: denial of service via use of EXPLAIN with certain
  queries
  - debian/patches/113_SECURITY_CVE-2010-3682.dpatch: improve conditional
    in sql/sql_select.cc. Add tests to mysql-test/*.
  - CVE-2010-3682
* SECURITY UPDATE: denial of service via derived table materializing.
  - debian/patches/113_SECURITY_CVE-2010-3834.dpatch: handle temporary
    tables in sql/field.cc, sql/sql_select.*. Add tests to mysql-test/*.
  - CVE-2010-3834
* SECURITY UPDATE: denial of service via pre-evaluation of LIKE
  predicates during view preparation.
  - debian/patches/113_SECURITY_CVE-2010-3836.dpatch: make sure we're not
    in view preparation mode in sql/item_cmpfunc.cc. Add tests to
    mysql-test/*.
  - CVE-2010-3836
* SECURITY UPDATE: denial of service via use of GROUP_CONCAT() and
  WITH ROLLUP together.
  - debian/patches/113_SECURITY_CVE-2010-3837.dpatch: create a copy of
    the order structures in sql/item_sum.cc, sql/table.h. Add tests to
    mysql-test/*.
  - CVE-2010-3837
* SECURITY UPDATE: denial of service via longblob and union or update
  with subquery.
  - debian/patches/113_SECURITY_CVE-2010-3838.dpatch: handle REAL_RESULT
    in sql/item_func.cc. Add tests to mysql-test/*.
  - CVE-2010-3838
* SECURITY UPDATE: denial of service via PolyFromWKB() function and
  improper data.
  - debian/patches/113_SECURITY_CVE-2010-3840.dpatch: improve data
    handling in sql/spatial.cc. Add tests to mysql-test/*.
  - CVE-2010-3840

21. By Marc Deslauriers on 2010-06-06

* SECURITY UPDATE: privilege check bypass via crafted table name argument
  to COM_FIELD_LIST
  - debian/patches/111_CVE-2010-1848.dpatch: check table name in
    sql/sql_parse.cc, Add tests to tests/mysql_client_test.c.
  - CVE-2010-1848
* SECURITY UPDATE: denial of service via large packets
  - debian/patches/110_CVE-2010-1849.dpatch: handle big packets in
    sql/sql_parse.cc, include/mysql_com.h, sql/net_serv.cc.
  - CVE-2010-1849
* SECURITY UPDATE: arbitrary code execution via crafted table name
  argument to COM_FIELD_LIST
  - debian/patches/109_CVE-2010-1850.dpatch: check table name length in
    sql/sql_parse.cc.
  - CVE-2010-1850
* SECURITY UPDATE: DROP TABLE privilege bypass via symlink attack
  - debian/patches/112_CVE-2010-1626.dpatch: check for symlinks in
    myisam/mi_delete_table.c.
  - CVE-2010-1626

20. By Marc Deslauriers on 2010-02-08

* SECURITY UPDATE: Cross-site scripting in the command-line client
  - debian/patches/108_CVE-2008-4456.dpatch: use xmlencode_print in
    client/mysql.cc, add test to mysql-test/*.
  - CVE-2008-4456
* SECURITY UPDATE: format string vulnerabilities in the dispatch_command
  function
  - debian/patches/108_CVE-2009-2446.dpatch: use correct format string in
    sql/sql_parse.cc, add test to tests/mysql_client_test.c.
  - CVE-2009-2446
* SECURITY UPDATE: denial of service via certain SELECT statements with
  subqueries and statements that use the GeomFromWKB function
  - debian/patches/108_CVE-2009-4019.dpatch: handle errors in
    sql/sql_select.cc, set correct null_value in sql/item_geofunc.cc, add
    tests to mysql-test/*.
  - CVE-2009-4019
* SECURITY UPDATE: privilege restriction bypass via incorrect calculation
  of the mysql_unpacked_real_data_home value
  - debian/patches/108_CVE-2009-4030.dpatch: fix initialization order in
    sql/mysqld.cc.
  - CVE-2009-4030

19. By Marc Deslauriers on 2008-11-10

* SECURITY UPDATE: denial of service via an empty bit-string literal (b'')
  - debian/patches/106_SECURITY_CVE-2008-3963.dpatch: fix Item_bin_string::
    Item_bin_string() in sql/item.cc to parse an empty bit-string literal
    as an empty string.
  - CVE-2008-3963
* SECURITY UPDATE: privilege circumvention via the creation of MyISAM
  tables using the DATA DIRECTORY and INDEX DIRECTORY options to overwrite
  existing table files in the data directory. This update is a complete
  fix for the three CVE numbers listed below. This fix alters table creation
  behaviour by disallowing the use of the MySQL data directory in DATA
  DIRECTORY and INDEX DIRECTORY options. (LP: #254129)
  - debian/patches/107_SECURITY_CVE-2008-4098.dpatch: Disallow use of MySQL
    data directory in DATA DIRECTORY and INDEX DIRECTORY options.
  - CVE-2008-2079
  - CVE-2008-4097
  - CVE-2008-4098

18. By Jamie Strandboge on 2008-04-01

Fix for upstream bug #20482: Creation of a view as a join of views or
tables could fail if the views or tables are in different databases. This
bug was introduced in the update for CVE-2007-2692, which had more
restrictive privilege checks. (LP: #209699)

17. By Jamie Strandboge on 2008-03-19

no change build for -security upload

16. By Jamie Strandboge on 2007-12-19

* SECURITY UPDATE: denial of service via crafted CONTAINS operation when
  using InnoDB
* debian/patches/98_SECURITY_CVE-2007-5925.dpatch: make sure innodb returns
  error on unsupported operations (db0err.h, page0cur.h, ha_innodb.cc). Also
  updated mysqld_error.h, mysqld_ername.h and errmsg.txt for the new
  returned error
* SECURITY UPDATE: privilege escalation using symlinks when using DATA
  DIRECTORY and INDEX DIRECTORY options via a RENAME TABLE statement
* debian/patches/98_SECURITY_CVE-2007-5969.dpatch: fix for my_symlink2.c to
  properly check symlinks when performing a rename operation
* SECURITY UPDATE: denial of service via SHOW TABLE STATUS query in
  federated engine
* debian/patches/98_SECURITY_CVE-2007-6304.dpatch: fix for ha_federated.cc
  to to return error if the response doesn't have enough columns
* SECURITY UPDATE: information disclosure when using CREATE TABLE LIKE
  statements
* debian/patches/98_SECURITY_CVE-2007-3781.dpatch: fix to enforce access
  privileges (sql_parse.cc, handler.h, sql_yacc.yy)
* debian/control: Build-Depends on bison
* References
  CVE-2007-5925
  CVE-2007-5969
  CVE-2007-6304
  CVE-2007-3781
  LP #172260

15. By Jamie Strandboge on 2007-10-02

* SECURITY UPDATE: denial of service via crafted IF clause
* debian/patches/SECURITY_CVE-2007-2583.dpatch: fix sql/item_cmpfunc.cc
  to verify res is not NULL
* SECURITY UPDATE: privilege escalation
* debian/patches/SECURITY_CVE-2007-2691.dpatch: fix sql/sql_parse.cc to
  make sure DROP privileges are required when using RENAME TABLE
  statements
* SECURITY UPDATE: denial of service via crafted authentication
  request
* debian/patches/SECURITY_CVE-2007-3780.dpatch: fix sql/sql_parse.cc to
  not overflow a signed char
* SECURITY UPDATE: privilege escalation via views
* debian/patches/SECURITY_CVE-2007-3782.dpatch: fix sql/sql_prepare.cc
  and sql/sql_update.cc to properly verify access privileges to
  external tables
* SECURITY UPDATE: warn on startup if root mysql account has a blank
  password. debian/mysql-server-5.0.mysql.init: supply 'reset-password' and
  check for blank password. Based on work by Soren Hansen.
* References
  CVE-2007-2583
  CVE-2007-2691
  CVE-2007-3780
  CVE-2007-3782
  Launchpad #119075

14. By Kees Cook on 2007-03-15

* SECURITY UPDATE: denial of service via subselects.
* debian/patches/46_CVE-2007-1420_subselect_dos.dpatch: backported from
  Debain upstream.
* debian/rules: disabled debconf-updatepo for security update.
* References
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414790
  CVE-2007-1420

13. By Martin Pitt on 2006-09-05

Fix CVE number in previous changelog and dpatch name.