| Package | Affected versions | Patched versions |
|---|---|---|
| mysql | = 5.1.23= 5.1.32= 5.1.5 | |
| mysql | = 5.1= 5.1.1= 5.1.10= 5.1.11= 5.1.12= 5.1.13= 5.1.14= 5.1.15= 5.1.16= 5.1.17= 5.1.18= 5.1.19= 5.1.2= 5.1.20= 5.1.21= 5.1.22= 5.1.3= 5.1.30= 5.1.4= 5.1.6= 5.1.7= 5.1.8= 5.1.9 |
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free