Moderate Security Alert: Buffer Overflow in mysql55-mysql on SL5 Systems

Date: Tue, 18 Feb 2014 20:03:13 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: mysql55-mysql on SL5.x i386/x86_64
MIME-Version: 1.0

Synopsis: Moderate: mysql55-mysql security update
Advisory ID: SLSA-2014:0186-1
Issue Date: 2014-02-18
CVE Numbers: CVE-2013-5908
 CVE-2014-0386
 CVE-2014-0393
 CVE-2014-0401
 CVE-2014-0402
 CVE-2014-0412
 CVE-2014-0437
 CVE-2014-0001
 CVE-2013-3839
 CVE-2013-5807
 CVE-2013-5891
 CVE-2014-0420
--

A buffer overflow flaw was found in the way the MySQL command line client
tool (mysql) processed excessively long version strings. If a user
connected to a malicious MySQL server via the mysql client, the server
could use this flaw to crash the mysql client or, potentially, execute
arbitrary code as the user running the mysql client. (CVE-2014-0001)

Upstream does not issue any more security advisories for the MySQL 5.0 packages (mysql-5.0.* and related packages).

The only trusted way to upgrade from MySQL 5.0 to MySQL 5.5 is by using MySQL 5.1 as an intermediate step. This is why the mysql51* Software Collection packages are provided. Note that the MySQL 5.1 packages are not supported and are provided only for the purposes of migrating to MySQL 5.5. You should not use the mysql51* packages on any of your production systems.

Specific instructions for this migration are provided by the upstream Deployment Guide.

After installing this update, the MySQL server daemon (mysqld) will be
restarted automatically.
--

SL5
 x86_64
 mysql55-mysql-5.5.36-2.el5.x86_64.rpm
 mysql55-mysql-bench-5.5.36-2.el5.x86_64.rpm
 mysql55-mysql-debuginfo-5.5.36-2.el5.x86_64.rpm
 mysql55-mysql-libs-5.5.36-2.el5.x86_64.rpm
 mysql55-mysql-server-5.5.36-2.el5.x86_64.rpm
 mysql55-mysql-test-5.5.36-2.el5.x86_64.rpm
 mysql55-mysql-debuginfo-5.5.36-2.el5.i386.rpm
 mysql55-mysql-devel-5.5.36-2.el5.i386.rpm
 mysql55-mysql-devel-5.5.36-2.el5.x86_64.rpm
 i386
 mysql55-mysql-5.5.36-2.el5.i386.rpm
 mysql55-mysql-bench-5.5.36-2.el5.i386.rpm
 mysql55-mysql-debuginfo-5.5.36-2.el5.i386.rpm
 mysql55-mysql-libs-5.5.36-2.el5.i386.rpm
 mysql55-mysql-server-5.5.36-2.el5.i386.rpm
 mysql55-mysql-test-5.5.36-2.el5.i386.rpm
 mysql55-mysql-devel-5.5.36-2.el5.i386.rpm

- Scientific Linux Development Team