MySQL: privilege violations [LWN.net]

Package(s):

mysql

CVE #(s):

CVE-2006-4031 CVE-2006-4226

Created:

August 25, 2006

Updated:

July 30, 2008

Description:

MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously created MERGE table, even after the user's privileges are revoked for the original table, which might violate intended security policy (CVE-2006-4031).

MySQL 4.1 before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions (CVE-2006-4226).

Alerts:

Red Hat	RHSA-2008:0768-01	2008-07-24
Red Hat	RHSA-2008:0364-01	2008-05-21
Red Hat	RHSA-2007:0152-01	2007-04-03
Red Hat	RHSA-2007:0083-01	2007-02-19
Fedora	FEDORA-2006-1298	2006-11-27
Fedora	FEDORA-2006-1297	2006-11-27
Ubuntu	USN-338-1	2006-09-05
Mandriva	MDKSA-2006:149	2006-08-24

(Log in to post comments)