Description
The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | mysql-dfsg-5.0 | 5.0.32-7etch3 | DSA-1413-1 |
| Debian 3.1 | mysql-dfsg | 4.0.24-10sarge3 | DSA-1413-1 |
| Debian 3.1 | mysql-dfsg-4.1 | 4.1.11a-4sarge8 | DSA-1413-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mysql +4 | 5.0.45-7.el5 | RHSA-2008:0364 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | mysql +6 | 5.0.44-1.el4s1.1 | RHSA-2007:0894 |
Advisories 3
- RHSA-2008:0364 Red Hat Security Advisory: mysql security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1413-1 mysql - multiple Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2007:0894 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 27823 third-party-advisory
- 29443 third-party-advisory
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html
- RHSA-2007:0894 vendor-advisory
- 26073 third-party-advisory
- MDVSA-2008:028 vendor-advisory
- [announce] 20070712 MySQL Community Server 5.0.45 has been released! mailing-list
- ADV-2007-1804 vdb-entry
- oval:org.mitre.oval:def:9166 vdb-entry signature
- 20070717 rPSA-2007-0143-1 mysql mysql-bench mysql-server mailing-list
- 1018070 vdb-entry
- mysql-changedb-privilege-escalation(34348) vdb-entry
- 25301 third-party-advisory
- DSA-1413 vendor-advisory
- https://issues.rpath.com/browse/RPL-1536
- 28637 third-party-advisory
- 30351 third-party-advisory
- http://bugs.mysql.com/bug.php?id=27337
- 26430 third-party-advisory
- 28838 third-party-advisory
- USN-588-1 vendor-advisory
- 34765 vdb-entry
- SUSE-SR:2008:003 vendor-advisory
- RHSA-2008:0364 vendor-advisory
- 24011 vdb-entry