Updated MySQL server packages for IBM iSeries and pSeries systems fix a number of security issues.
MySQL is a multi-user, multi-threaded SQL database server. A double-free vulnerability in mysqld, for MySQL before version 3.23.55, allows attackers with MySQL access to cause a denial of service (crash) by creating a carefully crafted client application. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0073 to this issue. MySQL 3.23.55 and earlier creates world-writable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart. (CAN-2003-0150) A signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.x to 3.23.53a allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call. (CAN-2002-1373) The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to 4.0.5a allows a remote attacker to gain privileges via a brute force attack using a one-character password. This causes MySQL to only compare the provided password against the first character of the real password. (CAN-2002-1374) The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to 4.0.5a allows remote attackers to execute arbitrary code via a long response. (CAN-2002-1375) The MySQL client library (libmysqlclient) in MySQL 3.x to 3.23.53a and 4.x to 4.0.5a does not properly verify length fields for certain responses in the read_rows or read_one_row routines, which allows a malicious server to cause a denial of service and possibly execute arbitrary code. (CAN-2002-1376) All users of MySQL are advised to upgrade to MySQL 3.23.56 contained within this errata, which is not vulnerable to these issues. In addition to the security fixes, these erratum packages contain a thread safe client library (libmysqlclient_r).