mysql-dfsg-5.0 5.0.22-0ubuntu6.06.1 source package in Ubuntu

Changelog

mysql-dfsg-5.0 (5.0.22-0ubuntu6.06.1) dapper-security; urgency=low

  * SECURITY UPDATE: Privilege escalation.
  * Add debian/patches/SECURITY_CVE-2006-3041.dpatch:
    - Add --{skip-}merge options to disable the MERGE engine.
    - This closes a potential pitfall when an user creates a merge table, and
      the admin revokes privileges to the original table without revoking
      privs to the merged table, too.
    - Patch ported from upstream BK commit.
    - References:
      CVE-2006-3041
      http://bugs.mysql.com/bug.php?id=15195
  * Note: This version is not vulnerable against the case sensitive database
    name comparison bug [CVE-2006-4226].
  * Add debian/patches/SECURITY_CVE-2006-4227.dpatch:
    - Routine arguments were evaluated in the security context of the routine
      itself, not in the caller's context. This could be exploited for
      privilege escalation in setuid functions.
    - Patch ported from Debian's 5.0.24-3 upload.
    - References:
      CVE-2006-4227
      http://bugs.mysql.com/bug.php?id=18630

 -- Martin Pitt <email address hidden>   Mon,  4 Sep 2006 14:37:59 +0000