This MySQL 5.0.21 release includes the patches for recently
reported security vulnerabilites in the MySQL client-server
protocol. We would like to thank Stefano Di Paola
<stefano.dipaola@wisec.it>
for finding and
reporting these to us.
Bugs fixed:
Security Fix:
Invalid arguments to
DATE_FORMAT()
caused a server
crash. Thanks to Jean-David Maillefer for discovering and
reporting this problem to the Debian project and to Christian
Hammers from the Debian Team for notifying us of it.
(Bug#20729, CVE-2006-3469)
Security Fix:
A malicious client, using specially crafted invalid
COM_TABLE_DUMP
packets was able to trigger an
exploitable buffer overflow on the server. Thanks to Stefano Di
Paola <stefano.dipaola@wisec.it>
for finding and
reporting this bug.
(CVE-2006-1518)
Security Fix:
A malicious client, using specially crafted invalid login or
COM_TABLE_DUMP
packets was able to read
uninitialized memory, which potentially, though unlikely in
MySQL, could have led to an information disclosure. (, ) Thanks
to Stefano Di Paola <stefano.dipaola@wisec.it>
for
finding and reporting this bug.
(CVE-2006-1516, CVE-2006-1517)