---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis: Updated mysql packages available for Red Hat Linux 7
Advisory ID: RHSA-2001:003-07
Issue date: 2001-01-18
Updated on: 2001-01-23
Product: Red Hat Linux
Keywords: mysql security buffer overflow
Cross references:
Obsoletes: RHBA-2000:133 RHBA-2000:067
---------------------------------------------------------------------

1. Topic:

The MySQL database that shipped with Red Hat Linux 7 and the updates for it
have been reported by the MySQL authors to have security problems.

2. Relevant releases/architectures:

Red Hat Linux 7.0 - alpha, i386

3. Problem description:

The MySQL database that shipped with Red Hat Linux 7 and the updates for
it have been reported by the MySQL authors to have security problems.

These problems (buffer overflow and information protection issues) have
been fixed in version 3.23.32, which also contains the earlier fixes.

Note that MySQL has updated its client library since the initial version
shipped with Red Hat Linux 7. A new package, mysqlclient9, must be used
for running applications linked with the libmysqlclient.so.9 library.

4. Solution:

Because of dependencies, the packages must be installed as a group.

After downloading all RPMs needed for your particular architecture, run:

rpm -Uvh mysql*

Note that in rare cases, the shutdown of the old database fails after
upgrade - to ensure a smooth upgrade, shut the database down before
upgrading:

service mysqld stop

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

24381 - Buffer Overflow in MySQL <3.23.31
22649 - encrypt() function not supported
24589 - mysql logrotate script returns an error, log doesn't get rotated

6. RPMs required:

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/SRPMS/mysql-3.23.32-1.7.src.rpm
ftp://updates.redhat.com/7.0/SRPMS/mysqlclient9-3.23.22-3.src.rpm

alpha:
ftp://updates.redhat.com/7.0/alpha/mysql-3.23.32-1.7.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/mysql-devel-3.23.32-1.7.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/mysql-server-3.23.32-1.7.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/mysqlclient9-3.23.22-3.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/i386/mysql-3.23.32-1.7.i386.rpm
ftp://updates.redhat.com/7.0/i386/mysql-devel-3.23.32-1.7.i386.rpm
ftp://updates.redhat.com/7.0/i386/mysql-server-3.23.32-1.7.i386.rpm
ftp://updates.redhat.com/7.0/i386/mysqlclient9-3.23.22-3.i386.rpm

7. Verification:

MD5 sum Package Name
--------------------------------------------------------------------------
1d13ef56b8898abf8841510db3c0be49 7.0/SRPMS/mysql-3.23.32-1.7.src.rpm
f538d811ec522c86ab890657e859a4f4 7.0/SRPMS/mysqlclient9-3.23.22-3.src.rpm
c838e7245d2ca45357e556317873fcca 7.0/alpha/mysql-3.23.32-1.7.alpha.rpm
5a5049769bd785e800fe629c7875dec8 7.0/alpha/mysql-devel-3.23.32-1.7.alpha.rpm
5cb73bca58042bb7604361c224878f08 7.0/alpha/mysql-server-3.23.32-1.7.alpha.rpm
e5f65a87cb3e019456d842d565693476 7.0/alpha/mysqlclient9-3.23.22-3.alpha.rpm
d8097aa8c188b386803267446286a01a 7.0/i386/mysql-3.23.32-1.7.i386.rpm
528a72c7b017458f6cad65978b93305e 7.0/i386/mysql-devel-3.23.32-1.7.i386.rpm
8ec7d8b903e1608de50f49196837e40c 7.0/i386/mysql-server-3.23.32-1.7.i386.rpm
38a96abb2b68fa9354f715da47767386 7.0/i386/mysqlclient9-3.23.22-3.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
    http://www.redhat.com/corp/contact.html

You can verify each package with the following command:
    rpm --checksig <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:

http://www.mysql.com/documentation/mysql/bychapter/manual_News.html#News-3.23.31

Copyright(c) 2000, 2001 Red Hat, Inc.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]