Description
MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously created MERGE table, even after the user's privileges are revoked for the original table, which might violate intended security policy.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mysql +4 | 5.0.45-7.el5 | RHSA-2008:0364 |
| RHEL 4 | mysql +3 | 4.1.22-2.el4 | RHSA-2008:0768 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | mysql +4 | 5.0.30-1.el4s1.1 | RHSA-2007:0083 |
Advisories 3
- RHSA-2008:0364 Red Hat Security Advisory: mysql security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0768 Red Hat Security Advisory: mysql security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0083 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jan 7, 2026
References
- 21259 third-party-advisory
- 21627 third-party-advisory
- TA07-072A third-party-advisory
- SUSE-SR:2006:023 vendor-advisory
- APPLE-SA-2007-03-13 vendor-advisory
- ADV-2006-3079 vdb-entry
- 19279 vdb-entry
- USN-338-1 vendor-advisory
- 31226 third-party-advisory
- oval:org.mitre.oval:def:10468 vdb-entry signature
- http://docs.info.apple.com/article.html?artnum=305214
- RHSA-2008:0768 vendor-advisory
- 21382 third-party-advisory
- MDKSA-2006:149 vendor-advisory
- 22080 third-party-advisory
- 21770 third-party-advisory
- 21685 third-party-advisory
- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-24.html
- http://dev.mysql.com/doc/refman/4.1/en/news-4-1-21.html
- 1016617 vdb-entry
- http://bugs.mysql.com/bug.php?id=15195
- 30351 third-party-advisory
- ADV-2007-0930 vdb-entry
- RHSA-2007:0083 vendor-advisory
- https://issues.rpath.com/browse/RPL-568
- RHSA-2008:0364 vendor-advisory
- 24479 third-party-advisory