oss-security - Re: CVE requests; issues fixed in MySQL 5.1.52

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1606538479.1272180.1310495267637.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Tue, 12 Jul 2011 14:27:47 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE requests; issues fixed in MySQL 5.1.52

Did these ever get IDs? I've been away and don't want to dupe these.

Thanks.

-- 
    JB

----- Original Message -----
> Vincent Danen wrote:
> > I see the following changes as fixed in MySQL 5.1.52, but cannot
> > find
> > any CVEs for them:
> >
> > InnoDB Storage Engine: Security Fix: Issuing TRUNCATE TABLE and
> > examining the same table's information in the INFORMATION_SCHEMA
> > database at the same time could cause a crash in the debug version
> > of
> > the server. (Bug #54678)
> >
> > Security Fix: The server crashed for assignment of values of types
> > other
> > than Geometry to items of type GeometryCollection (MultiPoint,
> > MultiCurve, MultiSurface). Now the server checks the field type and
> > fails with bad geometry value if it detects incorrect parameters.
> > (Bug
> > #55531)
> >
> > Security Fix: EXPLAIN EXTENDED caused a server crash with some
> > prepared
> > statements. (Bug #54494)
> >
> > Security Fix: In prepared-statement mode, EXPLAIN for a SELECT from
> > a
> > derived table caused a server crash. (Bug #54488)
> >
> > There are a whole bunch of other crash-type bugs corrected in 5.1.52
> > that upstream did not explicitly flag as security, which might be
> > considered security-relevant as well:
> >
> > http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html
> 
> Looks like this CVE request got lost.
> 
> cu
> Ludwig
> 
> --
> (o_ Ludwig Nussel
> //\
> V_/_ http://www.suse.de/
> SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix
> Imendörffer, HRB 16746 (AG Nürnberg)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.