Debian: DSA-212-1 Critical: MySQL Memory Corruption and Code Execution

Package : mysql
Problem type : multiple problems
Debian-specific: no
CVE references : CAN-2002-1373, CAN-2002-1374, CAN-2002-1375, CAN-2002-1376

While performing an audit of MySQL e-matters found several problems:

* signed/unsigned problem in COM_TABLE_DUMP
Two sizes were taken as signed integers from a request and then cast
to unsigned integers without checking for negative numbers. Since the
resulting numbers where used for a memcpy() operation this could lead
to memory corruption.

* Password length handling in COM_CHANGE_USER
When re-authenticating to a different user MySQL did not perform
all checks that are performed on initial authentication. This created
two problems:
* it allowed for single-character password brute forcing (as was fixed in
February 2000 for initial login) which could be used by a normal user to
gain root privileges to the database
* it was possible to overflow the password buffer and force the server
to execute arbitrary code

* read_rows(...