MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Mysql | — | Upgrade macOS to the latest version | Dec 16, 2011 | Nov 30, 2009 |
| Centos_linux | — | Upgrade mysql-develUpgrade mysql-serverUpgrade mysqlUpgrade mysql-testUpgrade mysql-bench | Dec 1, 2016 | Nov 30, 2009 |
| Oracle Mysql | — | Upgrade to Oracle MySQL version 5.1.41 | Aug 29, 2012 | Nov 30, 2009 |
| Oracle_linux | — | Upgrade mysql-benchUpgrade mysql-testUpgrade mysqlUpgrade mysql-serverUpgrade mysql-devel | Oct 16, 2024 | Nov 30, 2009 |
| Suse | — | Upgrade mariadb-100-errormessagesUpgrade mariadb104-benchUpgrade libmysqlclient15-x86Upgrade libmysql55client18-x86Upgrade mariadb104Upgrade mariadb104-rpm-macrosUpgrade mariadbUpgrade libmysqlclient-develUpgrade mariadb104-toolsUpgrade libmysqlclient_r18-32bitUpgrade mariadb104-errormessagesUpgrade mariadb-toolsUpgrade libmariadbd19Upgrade liblz4-1Upgrade mariadb-errormessagesUpgrade libmysqlclient_r15-x86Upgrade python3-mysqlclientUpgrade libmariadb-develUpgrade mysql-clientUpgrade mariadb-clientUpgrade libmysqlclient18-32bitUpgrade libmariadb3Upgrade mariadb104-testUpgrade libmysql55client_r18-x86Upgrade mariadb-benchUpgrade libmysqlclient_r18Upgrade libmariadb_pluginsUpgrade libmysqlclient18Upgrade mysql-MaxUpgrade libmysql55client18Upgrade libmysql55client_r18-32bitUpgrade mysql-toolsUpgrade libmysqlclient_r15Upgrade libmysql55client18-32bitUpgrade libmysqld-develUpgrade libmariadbd-develUpgrade libmysqld18Upgrade libmysqlclient15-32bitUpgrade libmysqlclient15Upgrade libmariadbd104-develUpgrade mariadb104-galeraUpgrade libmysql55client_r18Upgrade libmysqld19Upgrade libmysqlclient_r15-32bitUpgrade mariadb104-clientUpgrade mysql | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade mysql-server-5.0Upgrade mysql-server-5.1 | Nov 8, 2024 | Nov 30, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub