lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu Jun 1 20:05:46 2006 From: jmforbes at rpath.com (Justin M. Forbes) Subject: rPSA-2006-0089-1 mysql mysql-bench mysql-server rPath Security Advisory: 2006-0089-1 Published: 2006-06-01 Products: rPath Linux 1 Rating: Severe Exposure Level Classification: Local System User Deterministic Vulnerability Updated Versions: mysql=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1 mysql-bench=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1 mysql-server=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1 References: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2753 http://issues.rpath.com/browse/RPL-396 http://lists.mysql.com/announce/364 Description: Previous versions of mysql server and client libraries contain weaknesses parsing certain character encodings (such as SJIS, BIG5 and GBK, but not ASCII) which, when using the vulnerable encodings, can enable SQL injection attacks against applications (particularly web applications) which use non-standard escaping of quote characters. Because vulnerable escaping of quote characters is no longer allowed, some existing applications may not function correctly when used with the new release of mysql.
Powered by blists - more mailing lists