Bug 38520 - mysql-5.1: Multiple issues (3.2)
mysql-5.1: Multiple issues (3.2)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 3.2
Other Linux
: P1 normal (vote)
: UCS 3.2-5-errata
Assigned To: Arvid Requate
Janek Walkenhorst
https://lists.debian.org/debian-lts-a...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-05-12 15:10 CEST by Arvid Requate
Modified: 2015-05-18 13:50 CEST (History)
1 user (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score:
requate: Patch_Available+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2015-05-12 15:10:04 CEST
We should import the update for mysql-5.1 released by Debian Long Term Support, which fixes these issues:


* Insecure handling of a temporary file that could lead to abritrary
  execution of code through the creation of a mysql configuration file
  pointing to an attacker-controlled plugin_dir. (CVE-2014-4274)



* Insecure creation of the debian.cnf credential file. Credentials could
  be stolen by a local user monitoring that file while the package gets
  installed. (CVE-2013-2162)



* Buffer overrun in the MySQL client when the server sends a version
  string that is too big for the allocated buffer (CVE-2014-0001)



+++ This bug was initially created as a clone of Bug #33293 +++
Comment 1 Arvid Requate univentionstaff 2015-05-13 16:37:07 CEST
The version from squeeze-lts has been imported and built in errata3.2-5.

Advisory: 2015-05-13-mysql-5.1.yaml
Comment 2 Janek Walkenhorst univentionstaff 2015-05-15 17:45:28 CEST
Tests (amd64): OK
Advisory: OK
Comment 3 Janek Walkenhorst univentionstaff 2015-05-18 13:50:40 CEST
<http://errata.univention.de/ucs/3.2/331.html>