Bugs fixed:
Security Fix: Three vulnerabilities in yaSSL versions 1.7.5 and earlier were discovered that could lead to a server crash or execution of unauthorized code. The exploit requires a server with yaSSL enabled and TCP/IP connections enabled, but does not require valid MySQL account credentials. The exploit does not apply to OpenSSL.
The proof-of-concept exploit is freely available on the Internet. Everyone with a vulnerable MySQL configuration is advised to upgrade immediately.
Security Fix:
ALTER VIEW retained the original
DEFINER value, even when altered by another
user, which could allow that user to gain the access rights of
the view. Now ALTER VIEW is
allowed only to the original definer or users with the
SUPER privilege.
(Bug#29908)
Security Fix:
When using a FEDERATED table, the local
server could be forced to crash if the remote server returned a
result with fewer columns than expected.
(Bug#29801)
