Bugs fixed:
Security Fix: Three vulnerabilities in yaSSL versions 1.7.5 and earlier were discovered that could lead to a server crash or execution of unauthorized code. The exploit requires a server with yaSSL enabled and TCP/IP connections enabled, but does not require valid MySQL account credentials. The exploit does not apply to OpenSSL.
The proof-of-concept exploit is freely available on the Internet. Everyone with a vulnerable MySQL configuration is advised to upgrade immediately.
Security Fix:
ALTER VIEW
retained the original
DEFINER
value, even when altered by another
user, which could allow that user to gain the access rights of
the view. Now ALTER VIEW
is
allowed only to the original definer or users with the
SUPER
privilege.
(Bug#29908)
Security Fix:
When using a FEDERATED
table, the local
server could be forced to crash if the remote server returned a
result with fewer columns than expected.
(Bug#29801)