mysql-5.0.95-3.0.1.AXS3

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the MySQL client programs, the client shared libraries, and generic MySQL files.

Security issues fixed with this release:

• CVE-2012-4452
MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of a CVE-2009-4030 regression, which was not omitted in other packages and versions such as MySQL 5.0.95.

Fixed bugs:

• Previously, because the log file path in the logrotate script behaved unexpectedly, the logrotate function failed to rotate the "/var/log/mysqld.log" file. This has been fixed.

• Previously, mysqld sometimes failed when using the EXPLAIN flag in prepared statement mode. This has been fixed.

• Previously, the mysqld init script sometimes reported that mysql server startup had failed when it was actually started. This has been fixed.

• Previously, the "--enable-profiling" option was disabled by default; it is now enabled.