-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1783 security@debian.org
http://www.debian.org/security/ Devin Carraway
April 29, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : mysql-dfsg-5.0
Vulnerability : multiple
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2008-3963 CVE-2008-4456
Debian Bug : 498362
Multiple vulnerabilities have been identified affecting MySQL, a
relational database server, and its associated interactive client
application. The Common Vulnerabilities and Exposures project
identifies the following two problems:
CVE-2008-3963
Kay Roepke reported that the MySQL server would not properly handle
an empty bit-string literal in an SQL statement, allowing an
authenticated remote attacker to cause a denial of service (a crash)
in mysqld. This issue affects the oldstable distribution (etch), but
not the stable distribution (lenny).
CVE-2008-4456
Thomas Henlich reported that the MySQL commandline client application
did not encode HTML special characters when run in HTML output mode
(that is, "mysql --html ..."). This could potentially lead to
cross-site scripting or unintended script privilege escalation if
the resulting output is viewed in a browser or incorporated into
a web site.
For the old stable distribution (etch), these problems have been fixed in
version 5.0.32-7etch10.
For the stable distribution (lenny), these problems have been fixed in
version 5.0.51a-24+lenny1.
We recommend that you upgrade your mysql-dfsg-5.0 packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian (oldstable)
- ------------------
Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips,
mipsel, powerpc, s390 and sparc.
Source archives:
mysql-dfsg-5.0_5.0.32-7etch10.diff.gz
Size/MD5 checksum: 316316 8b223eaabb58e59dd94eb0d4a8c92aea
mysql-dfsg-5.0_5.0.32.orig.tar.gz
Size/MD5 checksum: 16439441 f99df050b0b847adf7702b44e79ac877
mysql-dfsg-5.0_5.0.32-7etch10.dsc
Size/MD5 checksum: 1119 dcbded9cba0e19d190fc2f77f134c550
Architecture independent packages:
mysql-server_5.0.32-7etch10_all.deb
Size/MD5 checksum: 48356 e97c3e229d72842f1dd5b4ee7f1251ce
mysql-client_5.0.32-7etch10_all.deb
Size/MD5 checksum: 46278 58c0f9871167c5cea7ef590300c1f615
mysql-common_5.0.32-7etch10_all.deb
Size/MD5 checksum: 55042 5e386582b3fd7d2b81f1ade654a00057
alpha architecture (DEC Alpha)
libmysqlclient15-dev_5.0.32-7etch10_alpha.deb
Size/MD5 checksum: 8906160 a16ce759550234c3f2dd0951a6eb89b4
mysql-server-5.0_5.0.32-7etch10_alpha.deb
Size/MD5 checksum: 27247262 396f7d23a26b3811c1962556e4178a29
libmysqlclient15off_5.0.32-7etch10_alpha.deb
Size/MD5 checksum: 1947978 6dafad44578cfa7b49b923351c3bd103
mysql-server-4.1_5.0.32-7etch10_alpha.deb
Size/MD5 checksum: 48372 c0729575a598fb0265280781b7365834
mysql-client-5.0_5.0.32-7etch10_alpha.deb
Size/MD5 checksum: 8405666 3464e330822fb59efbeafacd2e40ede4
amd64 architecture (AMD x86_64 (AMD64))
libmysqlclient15off_5.0.32-7etch10_amd64.deb
Size/MD5 checksum: 1832088 357250a49039aa2ccaa55f25e8e3968e
libmysqlclient15-dev_5.0.32-7etch10_amd64.deb
Size/MD5 checksum: 7381776 3638e4cd74fbbc929adb68d260c7a485
mysql-client-5.0_5.0.32-7etch10_amd64.deb
Size/MD5 checksum: 7548200 bdc8d651e463e0c4b7ed287b7ca1f43c
mysql-server-4.1_5.0.32-7etch10_amd64.deb
Size/MD5 checksum: 48378 4160e8467f4590b4e9f9be20acdd778d
mysql-server-5.0_5.0.32-7etch10_amd64.deb
Size/MD5 checksum: 25941038 081d5f54c7e3be08c7e8776e78e874a6
arm architecture (ARM)
mysql-server-4.1_5.0.32-7etch10_arm.deb
Size/MD5 checksum: 48434 b4f7a8ce2d9b4db432b0f8255751b313
mysql-client-5.0_5.0.32-7etch10_arm.deb
Size/MD5 checksum: 7208068 0c231cb7c1f1c44a44632721e3686a9f
libmysqlclient15off_5.0.32-7etch10_arm.deb
Size/MD5 checksum: 1748598 9390f41e7016ad267e49ff35c42069a9
libmysqlclient15-dev_5.0.32-7etch10_arm.deb
Size/MD5 checksum: 6931012 124a12ba4d32234f8a7eecefbc65ca1f
mysql-server-5.0_5.0.32-7etch10_arm.deb
Size/MD5 checksum: 25347856 7f872c65f8e45ca4b73e938a421a41fe
hppa architecture (HP PA RISC)
libmysqlclient15off_5.0.32-7etch10_hppa.deb
Size/MD5 checksum: 1922874 8af809572a8f0970dac614e56d0a2d99
libmysqlclient15-dev_5.0.32-7etch10_hppa.deb
Size/MD5 checksum: 8055770 e979e708351b181f66a87c3fc3e44c9a
mysql-client-5.0_5.0.32-7etch10_hppa.deb
Size/MD5 checksum: 8005312 2b073a674f3bca0c3556cb25e8a62f10
mysql-server-4.1_5.0.32-7etch10_hppa.deb
Size/MD5 checksum: 48374 3a4f39c4a25745201127193910de9ee6
mysql-server-5.0_5.0.32-7etch10_hppa.deb
Size/MD5 checksum: 27179176 d66966c0e6f071fe5a3e81127d819e77
i386 architecture (Intel ia32)
libmysqlclient15off_5.0.32-7etch10_i386.deb
Size/MD5 checksum: 1794446 45b8d5185af57d225dfc11f00a29d5c8
libmysqlclient15-dev_5.0.32-7etch10_i386.deb
Size/MD5 checksum: 6974340 5207734dfd742e027042a54c319272cc
mysql-server-5.0_5.0.32-7etch10_i386.deb
Size/MD5 checksum: 25369932 6ed97d08ede8b55091e283f28dcdac2c
mysql-server-4.1_5.0.32-7etch10_i386.deb
Size/MD5 checksum: 48428 edd5742646f29e51fcd12b5338daaad4
mysql-client-5.0_5.0.32-7etch10_i386.deb
Size/MD5 checksum: 7194866 2547f45553ed1e039c467893b6ce10de
ia64 architecture (Intel ia64)
mysql-server-5.0_5.0.32-7etch10_ia64.deb
Size/MD5 checksum: 30404436 219e25b2ba8b1366e01dfaf3031f9e96
mysql-client-5.0_5.0.32-7etch10_ia64.deb
Size/MD5 checksum: 10342956 0ffe68b9ba56ca766c123beaeff77fef
libmysqlclient15off_5.0.32-7etch10_ia64.deb
Size/MD5 checksum: 2115944 16a9e8364b4fb289a4899be8d183993a
mysql-server-4.1_5.0.32-7etch10_ia64.deb
Size/MD5 checksum: 48374 0eb939131872361ff04780f636737687
libmysqlclient15-dev_5.0.32-7etch10_ia64.deb
Size/MD5 checksum: 9739652 ac79de3f43873ecb69c966b66beca3f1
mipsel architecture (MIPS (Little Endian))
libmysqlclient15off_5.0.32-7etch10_mipsel.deb
Size/MD5 checksum: 1790138 294ac902b2dea86df6d24e602084964d
mysql-client-5.0_5.0.32-7etch10_mipsel.deb
Size/MD5 checksum: 7563528 734d80a47d138cd3ff9cb24593e1313b
mysql-server-4.1_5.0.32-7etch10_mipsel.deb
Size/MD5 checksum: 48378 90502bfe50ffef3ea1e7d70b741ac657
mysql-server-5.0_5.0.32-7etch10_mipsel.deb
Size/MD5 checksum: 25848476 f96b6b16c3cb3af6ead2ff16a05c9023
libmysqlclient15-dev_5.0.32-7etch10_mipsel.deb
Size/MD5 checksum: 7642696 82920ba66b11de45c84a75d090fb22e9
powerpc architecture (PowerPC)
libmysqlclient15off_5.0.32-7etch10_powerpc.deb
Size/MD5 checksum: 1833106 132dfeef44693f92d36b2051f5791d4f
mysql-server-5.0_5.0.32-7etch10_powerpc.deb
Size/MD5 checksum: 26169892 28732b89362d6101d176cefc10c29789
libmysqlclient15-dev_5.0.32-7etch10_powerpc.deb
Size/MD5 checksum: 7513800 eb88731a88e1d4fbcef8cae2ab55f761
mysql-client-5.0_5.0.32-7etch10_powerpc.deb
Size/MD5 checksum: 7575374 202cf90ca790e38d8ed2751e2fc4de1d
mysql-server-4.1_5.0.32-7etch10_powerpc.deb
Size/MD5 checksum: 48370 0de03d296210eb02dc71154d99a151da
s390 architecture (IBM S/390)
mysql-server-5.0_5.0.32-7etch10_s390.deb
Size/MD5 checksum: 26766454 8456de04aab0751e04d972165b10c526
libmysqlclient15-dev_5.0.32-7etch10_s390.deb
Size/MD5 checksum: 7415102 215aad68cadff5a34e94f8d5b66dc049
libmysqlclient15off_5.0.32-7etch10_s390.deb
Size/MD5 checksum: 1952590 21551cd175cef4cb7997e36e84f9ae47
mysql-server-4.1_5.0.32-7etch10_s390.deb
Size/MD5 checksum: 48370 450746f7967c185821d07c79017205c4
mysql-client-5.0_5.0.32-7etch10_s390.deb
Size/MD5 checksum: 7508160 aa838310e8ce8feb2edf94c986ebe207
sparc architecture (Sun SPARC/UltraSPARC)
mysql-server-5.0_5.0.32-7etch10_sparc.deb
Size/MD5 checksum: 25427664 882974f600f36ec287fe9211507f8f91
mysql-client-5.0_5.0.32-7etch10_sparc.deb
Size/MD5 checksum: 7153920 1bb209b696b198d154d36096973a0f57
libmysqlclient15-dev_5.0.32-7etch10_sparc.deb
Size/MD5 checksum: 7015286 654054bc87b497b9e689b83fed51f118
libmysqlclient15off_5.0.32-7etch10_sparc.deb
Size/MD5 checksum: 1798310 314ede7af23cfedf39c278a7285cfd1a
mysql-server-4.1_5.0.32-7etch10_sparc.deb
Size/MD5 checksum: 48372 fd8fe1ce0cc9fc0cfc21e98126f0bc50
Debian (stable)
- ---------------
Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64,
mips, mipsel, powerpc, s390 and sparc.
Source archives:
mysql-dfsg-5.0_5.0.51a-24+lenny1.diff.gz
Size/MD5 checksum: 341231 17ef8e070991c21b4a8ed27683e190ab
mysql-dfsg-5.0_5.0.51a-24+lenny1.dsc
Size/MD5 checksum: 1737 c66237a031cd9146316741285bca9766
mysql-dfsg-5.0_5.0.51a.orig.tar.gz
Size/MD5 checksum: 17946664 6fae978908ad5eb790fa3f24f16dadba
Architecture independent packages:
mysql-server_5.0.51a-24+lenny1_all.deb
Size/MD5 checksum: 54928 72442ba1cbd461b620193c9f12a4c1b1
mysql-common_5.0.51a-24+lenny1_all.deb
Size/MD5 checksum: 60526 af7672b88c91abc7ad32eeb5aba5d899
mysql-client_5.0.51a-24+lenny1_all.deb
Size/MD5 checksum: 52734 4b515755a8060b9c55847ac89d64dea2
alpha architecture (DEC Alpha)
libmysqlclient15off_5.0.51a-24+lenny1_alpha.deb
Size/MD5 checksum: 2017610 d7d73b71bde514bcddcc34ccb98179a3
libmysqlclient15-dev_5.0.51a-24+lenny1_alpha.deb
Size/MD5 checksum: 9078508 052950781ae733b36d98778892be6996
mysql-server-5.0_5.0.51a-24+lenny1_alpha.deb
Size/MD5 checksum: 28328874 0566b66e57a95d4a407f930624c4f62f
mysql-client-5.0_5.0.51a-24+lenny1_alpha.deb
Size/MD5 checksum: 8921072 6b4a65792a3e4a3a7898effdf3a88c1e
amd64 architecture (AMD x86_64 (AMD64))
libmysqlclient15off_5.0.51a-24+lenny1_amd64.deb
Size/MD5 checksum: 1905378 628959b2db2c6d53a946d95e1dcc6e05
libmysqlclient15-dev_5.0.51a-24+lenny1_amd64.deb
Size/MD5 checksum: 7586410 91c0bd72028fcfada249b84efc33416a
mysql-client-5.0_5.0.51a-24+lenny1_amd64.deb
Size/MD5 checksum: 8207538 3aed01edd6bb309d65ae6b19309a1231
mysql-server-5.0_5.0.51a-24+lenny1_amd64.deb
Size/MD5 checksum: 27157092 e48e558c67d6b9321e93a7fbe96f8138
arm architecture (ARM)
libmysqlclient15-dev_5.0.51a-24+lenny1_arm.deb
Size/MD5 checksum: 7159776 4cbac4a908b11789c697a691e501d837
mysql-client-5.0_5.0.51a-24+lenny1_arm.deb
Size/MD5 checksum: 7606116 45c146f3a63b77c64e4d3fae1012eded
mysql-server-5.0_5.0.51a-24+lenny1_arm.deb
Size/MD5 checksum: 26204724 446b1ec40a6e7a0e8f44fd63ee5c953a
libmysqlclient15off_5.0.51a-24+lenny1_arm.deb
Size/MD5 checksum: 1782032 55d2b300101a8a2ceb864d11163dff15
armel architecture (ARM EABI)
libmysqlclient15off_5.0.51a-24+lenny1_armel.deb
Size/MD5 checksum: 1779400 db26dc5db3cfb011576e191836e80342
mysql-client-5.0_5.0.51a-24+lenny1_armel.deb
Size/MD5 checksum: 7643540 01d16c6012e91fc2721cc56b01ae1e82
libmysqlclient15-dev_5.0.51a-24+lenny1_armel.deb
Size/MD5 checksum: 7250024 33dc67f1bbb58ee3b7976816b1a406c3
mysql-server-5.0_5.0.51a-24+lenny1_armel.deb
Size/MD5 checksum: 26214014 39846ba81302b2a50fdaafea01fcc980
hppa architecture (HP PA RISC)
libmysqlclient15-dev_5.0.51a-24+lenny1_hppa.deb
Size/MD5 checksum: 8167608 e3457b456652a8242cea25e194e68ea9
libmysqlclient15off_5.0.51a-24+lenny1_hppa.deb
Size/MD5 checksum: 1959000 6a9e206daa9ff3c6420d795eb6217eaa
mysql-client-5.0_5.0.51a-24+lenny1_hppa.deb
Size/MD5 checksum: 8429344 f0050bae59f71b8a8b36928e769e2e68
mysql-server-5.0_5.0.51a-24+lenny1_hppa.deb
Size/MD5 checksum: 27885032 bdf724ed1a3ae1e31d677b57daee4615
i386 architecture (Intel ia32)
mysql-client-5.0_5.0.51a-24+lenny1_i386.deb
Size/MD5 checksum: 7777192 8ef21b2713791403c9fde6e8e7cc6f09
mysql-server-5.0_5.0.51a-24+lenny1_i386.deb
Size/MD5 checksum: 26677468 b3865ed165188cd9cd469d52673e5ba4
libmysqlclient15off_5.0.51a-24+lenny1_i386.deb
Size/MD5 checksum: 1859970 4eb77733e322db626fc1953e3ce0edab
libmysqlclient15-dev_5.0.51a-24+lenny1_i386.deb
Size/MD5 checksum: 7197680 837eca5096e8288af8d7c87b1b2fc58b
ia64 architecture (Intel ia64)
mysql-client-5.0_5.0.51a-24+lenny1_ia64.deb
Size/MD5 checksum: 10914682 0f8c038e2bab8117a925f069b79b8b5f
libmysqlclient15-dev_5.0.51a-24+lenny1_ia64.deb
Size/MD5 checksum: 9933502 e6cb7e17cccb8fc46ec3f26279b7bd0b
libmysqlclient15off_5.0.51a-24+lenny1_ia64.deb
Size/MD5 checksum: 2186212 683687adae52d9c99743301959013f33
mysql-server-5.0_5.0.51a-24+lenny1_ia64.deb
Size/MD5 checksum: 31431258 3efd2ebba07a5dd225ce1725b7764c74
mips architecture (MIPS (Big Endian))
libmysqlclient15-dev_5.0.51a-24+lenny1_mips.deb
Size/MD5 checksum: 7838688 1fa47b0be2efa781d4baae56c949b4c1
libmysqlclient15off_5.0.51a-24+lenny1_mips.deb
Size/MD5 checksum: 1856112 b1329d54eb00d8fdcf688fae1e1ab1d5
mysql-server-5.0_5.0.51a-24+lenny1_mips.deb
Size/MD5 checksum: 26823126 b6788cc88c8a9ed89a84852cab1f8b78
mysql-client-5.0_5.0.51a-24+lenny1_mips.deb
Size/MD5 checksum: 7883724 075f6210bccdfde11084dcd6c38807db
mipsel architecture (MIPS (Little Endian))
libmysqlclient15-dev_5.0.51a-24+lenny1_mipsel.deb
Size/MD5 checksum: 7720858 23e3c02af493edd6d6493af4bc7250c5
libmysqlclient15off_5.0.51a-24+lenny1_mipsel.deb
Size/MD5 checksum: 1809730 9a376aaa0289b086086cae0f2cd38b36
mysql-client-5.0_5.0.51a-24+lenny1_mipsel.deb
Size/MD5 checksum: 7775746 6ff81d634ba56f85d5fefeb206d956cb
mysql-server-5.0_5.0.51a-24+lenny1_mipsel.deb
Size/MD5 checksum: 26342464 4f7d37a666c016c6ee1b4201452ce2f8
powerpc architecture (PowerPC)
libmysqlclient15off_5.0.51a-24+lenny1_powerpc.deb
Size/MD5 checksum: 1916268 0bc2ea2ef11e0643ddf1ff7baf2771d2
mysql-server-5.0_5.0.51a-24+lenny1_powerpc.deb
Size/MD5 checksum: 27153952 79af13c7ae97a1846cf47426add5db23
mysql-client-5.0_5.0.51a-24+lenny1_powerpc.deb
Size/MD5 checksum: 8152750 7eff89cf9541ba3e28a5bcf6ffef3668
libmysqlclient15-dev_5.0.51a-24+lenny1_powerpc.deb
Size/MD5 checksum: 7605402 395f7e23a4b9cb8511a0d19d8e1cce16
s390 architecture (IBM S/390)
libmysqlclient15-dev_5.0.51a-24+lenny1_s390.deb
Size/MD5 checksum: 7697458 ccfcfe29bcd5184f41f430b699dba62c
mysql-client-5.0_5.0.51a-24+lenny1_s390.deb
Size/MD5 checksum: 8226830 5cece6a80b492a781aadda362f58a730
mysql-server-5.0_5.0.51a-24+lenny1_s390.deb
Size/MD5 checksum: 28100750 4e83a4204f2e2ac7695a128695594df9
libmysqlclient15off_5.0.51a-24+lenny1_s390.deb
Size/MD5 checksum: 2031088 587d640431b7c9bb638d95cab27c1e8c
sparc architecture (Sun SPARC/UltraSPARC)
mysql-server-5.0_5.0.51a-24+lenny1_sparc.deb
Size/MD5 checksum: 26831224 a298056134e8022219a0239b011e2833
mysql-client-5.0_5.0.51a-24+lenny1_sparc.deb
Size/MD5 checksum: 7760640 d1e516164a185b5c8135f98bf72a2a5b
libmysqlclient15off_5.0.51a-24+lenny1_sparc.deb
Size/MD5 checksum: 1871516 877fa6da1c09343d77408a34cfec3929
libmysqlclient15-dev_5.0.51a-24+lenny1_sparc.deb
Size/MD5 checksum: 7142942 cc29b305dd77e60f9b37da6a96c1028d
These files will probably be moved into the stable distribution on
its next update.
-
---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-securitydists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJ+AgWU5XKDemr/NIRAuSCAKDAqKw0Y1bSMyJ1q1zzz0v1ueeaHQCgveg7
W9xYzhLiAb6LLByKC/46Xas=
=go15
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org
|
