lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu Jun  1 20:05:46 2006
From: jmforbes at rpath.com (Justin M. Forbes)
Subject: rPSA-2006-0089-1 mysql mysql-bench mysql-server

rPath Security Advisory: 2006-0089-1
Published: 2006-06-01
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Local System User Deterministic Vulnerability
Updated Versions:
    mysql=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1
    mysql-bench=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1
    mysql-server=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2753
    http://issues.rpath.com/browse/RPL-396
    http://lists.mysql.com/announce/364

Description:
    Previous versions of mysql server and client libraries contain
    weaknesses parsing certain character encodings (such as SJIS,
    BIG5 and GBK, but not ASCII) which, when using the vulnerable
    encodings, can enable SQL injection attacks against applications
    (particularly web applications) which use non-standard escaping of
    quote characters.
    
    Because vulnerable escaping of quote characters is no longer allowed,
    some existing applications may not function correctly when used with
    the new release of mysql.

Powered by blists - more mailing lists