Updated mysql packages fix the following bugs :

  - upstream #47320 - checking server certificates     (CVE-2009-4028)

  - upstream #48291 - error handling in subqueries     (CVE-2009-4019)

  - upstream #47780 - preserving null_value flag in     GeomFromWKB() (CVE-2009-4019)

  - upstream #39277 - symlink behaviour fixed     (CVE-2008-7247)

  - upstream #32167 - symlink behaviour refixed     (CVE-2009-4030)

Add backported patch for CVE-2008-7247 Use non-expired certificates for SSL testing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated MySQL packages fix the following bugs :

  - upstream #47320 - checking server certificates.
    (CVE-2009-4028)

  - upstream #48291 - error handling in subqueries.
    (CVE-2009-4019)

  - upstream #47780 - preserving null_value flag in     GeomFromWKB(). (CVE-2009-4019)

  - upstream #39277 - symlink behaviour fixed.
    (CVE-2008-7247)

  - upstream #32167 - symlink behaviour refixed     (CVE-2009-4030)

The remote Solaris system is missing necessary patches to address security updates :

  - MySQL before 5.0.67 allows local users to bypass certain     privilege checks by calling CREATE TABLE on a MyISAM     table with modified (1) DATA DIRECTORY or (2) INDEX     DIRECTORY arguments that are originally associated with     pathnames without symlinks, and that can point to tables     created at a future time at which a pathname is modified     to contain a symlink to a subdirectory of the MySQL home     data directory. NOTE: this vulnerability exists because     of an incomplete fix for CVE-2008-4097. (CVE-2008-4098)

  - sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x     through 5.1.41, and 6.0 before 6.0.9-alpha, when the     data home directory contains a symlink to a different     filesystem, allows remote authenticated users to bypass     intended access restrictions by calling CREATE TABLE     with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY     argument referring to a subdirectory that requires     following this symlink. (CVE-2008-7247)

  - MySQL before 5.1.46 allows local users to delete the     data and index files of another user's MyISAM table via     a symlink attack in conjunction with the DROP TABLE     command, a different vulnerability than CVE-2008-4098     and CVE-2008-7247. (CVE-2010-1626)

  - MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x     before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL     5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and     earlier allows remote attackers to cause a denial of     service (crash) via a crafted geometry feature that     specifies a large number of points, which is not     properly handled when processing the binary     representation of this feature, related to a numeric     calculation error. (CVE-2013-1861)

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0461 advisory.

    This advisory aggregates security fixes for the mysql SRPM in CIQ LTS 9.2. It addresses 187 CVEs:
    CVE-2019-2528, CVE-2017-3462, CVE-2018-3283, CVE-2018-2759, CVE-2019-2503, and 182 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability has been found and corrected in mysql :

MySQL is vulnerable to a symbolic link attack when the data home directory contains a symlink to a different filesystem which allows remote authenticated users to bypass intended access restrictions (CVE-2008-7247).

The updated packages have been patched to correct these issues.

This update fixes various security issues (bnc#557669) :

upstream #47320 - checking server certificates (CVE-2009-4028) upstream #48291 - error handling in subqueries (CVE-2009-4019) upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) upstream #39277 - symlink behaviour fixed (CVE-2008-7247) upstream #32167 - symlink behaviour refixed (CVE-2009-4030) fixing remote buffer overflow. (CVE-2009-4484)

This update fixes several security issues in mysql :

  - checking server certificates (CVE-2009-4028)

  - error handling in subqueries (CVE-2009-4019)

  - preserving null_value flag in GeomFromWKB     (CVE-2009-4019)

  - symlink behavior fixed (CVE-2008-7247)

  - symlink behavior refixed (CVE-2009-4030)

The version of MySQL 5.0 installed on the remote host is earlier than 5.0.88. It is, therefore, potentially affected by the following vulnerabilities :

  - MySQL clients linked against OpenSSL are vulnerable     to man-in-the-middle attacks. (Bug #47320)

  - The GeomFromWKB() function can be manipulated     to cause a denial of service. (Bug #47780)

  - Specially crafted SELECT statements containing sub-     queries in the WHERE clause can cause the server     to crash. (Bug #48291)

  - It is possible to bypass access restrictions when the     data directory contains a symbolic link to a different     file system. (Bug #39277)

The version of MySQL 5.1 installed on the remote host is earlier than 5.1.41 and is, therefore, potentially affected by the following vulnerabilities :

  - An incomplete fix was provided in 5.1.24 for     CVE-2008-2079, a symlink-related privilege     escalation issue. (Bug #39277)

  - MySQL clients linked against OpenSSL are vulnerable     to man-in-the-middle attacks. (Bug #47320)

  - The GeomFromWKB() function can be manipulated     to cause a denial of service. (Bug #47780)

  - Specially crafted SELECT statements containing sub-     queries in the WHERE clause can cause the server     to crash. (Bug #48291)

The following bugs have been fixed :

  - local users could delete data files for tables of other     users. (CVE-2010-1626)

  - authenticated users could gather information for tables     they should not have access to. (CVE-2010-1849)

  - authenticated users could crash mysqld. (CVE-2010-3683,     CVE-2010-3681, CVE-2010-1848)

  - authenticated users could bypass intended access     restrictions. (CVE-2008-7247, CVE-2009-4030)

ID	名稱	產品	系列	已發布	已更新	嚴重性
46235	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	2010/5/5	2021/1/14	medium
47248	Fedora 12 : mysql-5.1.42-7.fc12 (2010-1348)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
50935	SuSE 11 Security Update : MySQL (SAT Patch Number 2317)	Nessus	SuSE Local Security Checks	2010/12/2	2021/1/14	medium
80705	Oracle Solaris Third-Party Patch Update : mysql (multiple_vulnerabilities_in_mysql)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
46229	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	2010/5/5	2021/1/14	medium
46232	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)	Nessus	SuSE Local Security Checks	2010/5/5	2021/1/14	medium
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical
353739	Rocky Linux 9.2 [CIQ] Security Update: mysql / mysql-common / mysql-debuginfo / mysql-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0461)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	critical
48175	Mandriva Linux Security Advisory : mysql (MDVSA-2010:044)	Nessus	Mandriva Local Security Checks	2010/7/30	2021/1/6	medium
49903	SuSE 10 Security Update : MySQL (ZYPP Patch Number 6899)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	high
46219	openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)	Nessus	SuSE Local Security Checks	2010/5/4	2021/1/14	medium
47246	Fedora 11 : mysql-5.1.42-7.fc11 (2010-1300)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
42899	MySQL 5.0 < 5.0.88 Multiple Vulnerabilities	Nessus	Databases	2009/11/25	2018/11/15	medium
42900	MySQL 5.1 < 5.1.41 Multiple Vulnerabilities	Nessus	Databases	2009/11/25	2018/11/15	medium
50523	SuSE9 Security Update : MySQL (YOU Patch Number 12661)	Nessus	SuSE Local Security Checks	2010/11/9	2021/1/14	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

critical

critical

medium

high

medium

medium

medium

medium

medium