Bug 38520 - mysql-5.1: Multiple issues (3.2)
mysql-5.1: Multiple issues (3.2)
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 3.2
Other Linux
: P1 normal (vote)
: UCS 3.2-5-errata
Assigned To: Arvid Requate
Janek Walkenhorst
Depends on:
  Show dependency treegraph
Reported: 2015-05-12 15:10 CEST by Arvid Requate
Modified: 2015-05-18 13:50 CEST (History)
1 user (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score:
requate: Patch_Available+


Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2015-05-12 15:10:04 CEST
We should import the update for mysql-5.1 released by Debian Long Term Support, which fixes these issues:

* Insecure handling of a temporary file that could lead to abritrary
  execution of code through the creation of a mysql configuration file
  pointing to an attacker-controlled plugin_dir. (CVE-2014-4274)

* Insecure creation of the debian.cnf credential file. Credentials could
  be stolen by a local user monitoring that file while the package gets
  installed. (CVE-2013-2162)

* Buffer overrun in the MySQL client when the server sends a version
  string that is too big for the allocated buffer (CVE-2014-0001)

+++ This bug was initially created as a clone of Bug #33293 +++
Comment 1 Arvid Requate univentionstaff 2015-05-13 16:37:07 CEST
The version from squeeze-lts has been imported and built in errata3.2-5.

Advisory: 2015-05-13-mysql-5.1.yaml
Comment 2 Janek Walkenhorst univentionstaff 2015-05-15 17:45:28 CEST
Tests (amd64): OK
Advisory: OK
Comment 3 Janek Walkenhorst univentionstaff 2015-05-18 13:50:40 CEST