Description
sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to obtain sensitive information via a COM_TABLE_DUMP request with an incorrect packet length, which includes portions of memory in an error message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | mysql-dfsg | 4.0.24-10sarge2 | DSA-1079-1 |
| Debian 3.1 | mysql-dfsg-4.1 | 4.1.11a-4sarge3 | DSA-1073-1 |
| Debian 3.0 | mysql | 3.23.49-8.15 | DSA-1071-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | mysql +3 | 4.1.20-1.RHEL4.1 | RHSA-2006:0544 |
Advisories 4
- RHSA-2006:0544 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1071-1 mysql - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1073-1 mysql-dfsg-4.1 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1079-1 mysql-dfsg - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20060502 MySQL COM_TABLE_DUMP Information Leakage and Arbitrary commandexecution. mailing-list
- 2006-0028 vendor-advisory
- 19929 third-party-advisory
- 20073 third-party-advisory
- http://www.wisec.it/vulns.php?page=8
- TA07-072A third-party-advisory
- DSA-1079 vendor-advisory
- ADV-2006-1633 vdb-entry
- 20060516 UPDATE: [ GLSA 200605-13 ] MySQL: Information leakage mailing-list
- 20424 third-party-advisory
- GLSA-200605-13 vendor-advisory
- APPLE-SA-2007-03-13 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- oval:org.mitre.oval:def:11036 vdb-entry signature
- SUSE-SA:2006:036 vendor-advisory
- 839 third-party-advisory
- 25228 vdb-entry
- SUSE-SR:2006:012 vendor-advisory
- 17780 vdb-entry
- MDKSA-2006:084 vendor-advisory
- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html
- 20241 third-party-advisory
- 20762 third-party-advisory
- 236703 vendor-advisory
- SSA:2006-155-01 vendor-advisory
- 20333 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=365939
- 20002 third-party-advisory
- 20223 third-party-advisory
- 20076 third-party-advisory
- 1016016 vdb-entry
- DSA-1071 vendor-advisory
- ADV-2008-1326 vdb-entry
- ADV-2007-0930 vdb-entry
- 20253 third-party-advisory
- USN-283-1 vendor-advisory
- 20457 third-party-advisory
- DSA-1073 vendor-advisory
- mysql-sqlparcecc-information-disclosure(26228) vdb-entry
- 29847 third-party-advisory
- 20625 third-party-advisory
- RHSA-2006:0544 vendor-advisory
- 24479 third-party-advisory