rPath Security Advisory: 2006-0089-1 Published: 2006-06-01 Products: rPath Linux 1 Rating: Severe Exposure Level Classification: Local System User Deterministic Vulnerability Updated Versions: mysql=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1 mysql-bench=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1 mysql-server=/conary.rpath.com@rpl:devel//1/5.0.22-1-0.1 References: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2753 http://issues.rpath.com/browse/RPL-396 http://lists.mysql.com/announce/364 Description: Previous versions of mysql server and client libraries contain weaknesses parsing certain character encodings (such as SJIS, BIG5 and GBK, but not ASCII) which, when using the vulnerable encodings, can enable SQL injection attacks against applications (particularly web applications) which use non-standard escaping of quote characters. Because vulnerable escaping of quote characters is no longer allowed, some existing applications may not function correctly when used with the new release of mysql. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/