Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Fedora: FEDORA-2021:1234-01 Important: postgresql Security Vulnerabilities

red hat
Calendar Grey November 3, 2010
Dist Redhat Esm H88
A new patch for Red Hat Enterprise Linux 4 tackles important MySQL vulnerabilities along with necessary repairs. Learn more!
Updated mysql packages that fix three security issues are now available for Red Hat Enterprise Linux 4

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

Summary

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.
It was found that the MySQL PolyFromWKB() function did not sanity check Well-Known Binary (WKB) data. A remote, authenticated attacker could use specially-crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3840)
A flaw was found in the way MySQL processed certain alternating READ requests provided by HANDLER statements. A remote, authenticated attacker could use this flaw to provide such requests, causing mysqld to crash. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash. (CVE-2010-3681)
A directory traversal flaw was found in the way MySQL handled the parameters of the MySQL COM_FIELD_LIST network protocol command. A remote, authenticated attacker could use this flaw to obtain descriptions of the fields of an arbitrary table using a request with a specially-crafted table name. (CVE-2010-1848)
All MySQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.

Topics%20covered

Topics Covered

security advisory moderate mysql red hat enterprise linux security issues dos

References

https://access.redhat.com/security/cve/CVE-2010-1848 https://access.redhat.com/security/cve/CVE-2010-3681 https://access.redhat.com/security/cve/CVE-2010-3840 https://access.redhat.com/security/updates/classification#moderate

Package List

Red Hat Enterprise Linux AS version 4:
Source:
i386: mysql-4.1.22-2.el4_8.4.i386.rpm mysql-bench-4.1.22-2.el4_8.4.i386.rpm mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm mysql-devel-4.1.22-2.el4_8.4.i386.rpm mysql-server-4.1.22-2.el4_8.4.i386.rpm
ia64: mysql-4.1.22-2.el4_8.4.i386.rpm mysql-4.1.22-2.el4_8.4.ia64.rpm mysql-bench-4.1.22-2.el4_8.4.ia64.rpm mysql-debuginfo-4.1.22-2.el4_8.4.i386.rpm mysql-debuginfo-4.1.22-2.el4_8.4.ia64.rpm mysql-devel-4.1.22-2.el4_8.4.ia64.rpm mysql-server-4.1.22-2.el4_8.4.ia64.rpm
ppc: mysql-4.1.22-2.el4_8.4.ppc.rpm mysql-4.1.22-2.el4_8.4.ppc64.rpm mysql-bench-4.1.22-2.el4_8.4.ppc.rpm mysql-debuginfo-4.1.22-2.el4_8.4.ppc.rpm mysql-debuginfo-4.1.22-2.el4_8.4.ppc64.rpm mysql-devel-4.1.22-2.el4_8.4.ppc.rpm mysql-server-4.1.22-2.el4_8.4.ppc.rpm
s390: mysql-4.1.22-2.el4_8.4.s390.rpm mysql-bench-4.1.22-2.el4_8.4.s390.rpm mysql-debuginfo-4.1.22-2.el4_8.4.s390.rpm mysql-devel-4.1.22-2.el4_8.4.s390.rpm mysql-server-4.1.22-2.el4_8.4.s390.rpm
s390x: mysql-4.1.22-2.el4_8.4.s390.rpm mysql-4.1.22-2.el4_8.4.s390x.rpm mysql-bench-4.1.22-2.el4_8.4.s390x.rpm mysql-debuginfo-4.1.22-2.el4_8.4.s390.rpm mysql-debuginfo-4.1.22-2.el4_8.4.s390x.rpm mysql-devel-4.1.22-2.el4_8.4.s390x.rpm mysql-server-4.1.22-2.el4_8.4.s390x.rpm
x86_64:

Read the Full Advisory


Advisory ID: RHSA-2010:0824-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2010:0824.html
Issue date: 2010-11-03

Topic

Updated mysql packages that fix three security issues are now available forRed Hat Enterprise Linux 4.The Red Hat Security Response Team has rated this update as having moderatesecurity impact. Common Vulnerability Scoring System (CVSS) base scores,which give detailed severity ratings, are available for each vulnerabilityfrom the CVE links in the References section.

Topics%20covered

Topics Covered

security advisory moderate mysql red hat enterprise linux security issues dos

Relevant Releases Architectures

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Enterprise Linux Desktop version 4 - i386, x86_64

Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

Bugs Fixed

592079 - CVE-2010-1848 mysql: multiple insufficient table name checks

628680 - CVE-2010-3681 MySQL: mysqld DoS (assertion failure) by alternate reads from two indexes on a table using the HANDLER interface (MySQL bug #54007)

640865 - CVE-2010-3840 MySQL: crash when loading data into geometry function PolyFromWKB() (MySQL Bug#51875)

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here