LWN.net Logo

mysql: multiple vulnerabilities

Package(s):mysql-5.5, mysql-dfsg-5.1 CVE #(s):CVE-2013-2162 CVE-2013-3783 CVE-2013-3793 CVE-2013-3809 CVE-2013-3812
Created:July 26, 2013 Updated:August 14, 2013
Description: From the Debian and Ubuntu bug reports:

CVE-2013-2162: The file "/etc/mysql/debian.cnf", which contains plain text credentials for the "debian-sys-maint" mysql user, is created in an insecure manner during the package installation phase. This can lead a non-privileged local user to disclose its content and use this special account to perform administration tasks.

CVE-2013-3783: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Parser.

CVE-2013-3793: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.

CVE-2013-3809: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Audit Log.

CVE-2013-3812: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Replication.

Alerts:
Ubuntu USN-1909-1 2013-07-25
openSUSE openSUSE-SU-2013:1335-1 2013-08-14
SUSE SUSE-SU-2013:1390-1 2013-08-30

(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds