Description
MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | mysql-dfsg-5.0 | 5.0.51a-9+lenny2 | DTSA-150-1 |
| Debian 4.0 | mysql-dfsg-5.0 | 5.0.32-7etch6 | DSA-1608-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mysql +4 | 5.0.77-3.el5 | RHSA-2009:1289 |
| RHEL 4 | mysql +3 | 4.1.22-2.el4 | RHSA-2008:0768 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.8-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mod_jk +1 | 1.2.26-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mod_perl +1 | 2.0.4-3.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.8-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mysql +6 | 5.0.50sp1a-2.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mysql-connector-odbc | 3.51.24r1071-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mysql-jdbc | 5.0.8-1jpp.1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | perl-DBD-MySQL | 4.006-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | perl-DBI | 1.604-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | php +18 | 5.2.6-2.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresql +11 | 8.2.9-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresql-jdbc | 8.2.508-1jpp.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresql-odbc | 08.02.0500-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresqlclient81 | 8.1.11-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | unixODBC +2 | 2.2.12-8.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 1 | httpd +2 | 2.0.63-2.el4s1.2 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | mod_jk +2 | 1.2.26-1.el4s1.1 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | mod_ssl | 1:2.0.63-2.el4s1.2 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | mysql +6 | 5.0.50sp1a-2.el4s1.1 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | mysql-connector-odbc | 3.51.24r1071-1.el4s1.1 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | perl-DBD-MySQL | 4.006-1.el4 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | perl-DBI | 1.604-1.el4s1 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.9 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | postgresql-jdbc | 8.1.412-1jpp.el4s1.1 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | postgresqlclient7 | 7.4.19-1.el4s1.1 | RHSA-2008:0510 |
| Red Hat Rhel Application Stack 1 | unixODBC +2 | 2.2.12-6.el4s1.1 | RHSA-2008:0510 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | mariadb104 | 10.4.30-150100.3.5.10 | SUSE-RU-2023:3956-1 |
| SLES 15 SP1 | python-mysqlclient | 1.4.6-150100.3.3.7 | SUSE-RU-2023:3956-1 |
| SLES 12 SP5 | lz4 | 1.8.0-3.5.2 | SUSE-RU-2023:4991-1 |
| SLES 12 SP5 | mariadb-connector-c | 3.1.22-2.35.1 | SUSE-RU-2023:4991-1 |
| SLES 12 SP5 | mariadb104 | 10.4.30-8.5.46 | SUSE-RU-2023:4991-1 |
| SLES 12 SP5 | python-mysqlclient | 1.3.14-8.9.2 | SUSE-RU-2023:4991-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | mariadb104 | 10.4.30-150100.3.5.10 | SUSE-RU-2023:3956-1 |
| SLES for SAP 15 SP1 | python-mysqlclient | 1.4.6-150100.3.3.7 | SUSE-RU-2023:3956-1 |
| SLES for SAP 12 SP5 | lz4 | 1.8.0-3.5.2 | SUSE-RU-2023:4991-1 |
| SLES for SAP 12 SP5 | mariadb-connector-c | 3.1.22-2.35.1 | SUSE-RU-2023:4991-1 |
| SLES for SAP 12 SP5 | mariadb104 | 10.4.30-8.5.46 | SUSE-RU-2023:4991-1 |
| SLES for SAP 12 SP5 | python-mysqlclient | 1.3.14-8.9.2 | SUSE-RU-2023:4991-1 |
| SLE HPC 15 SP1 | mariadb104 | 10.4.30-150100.3.5.10 | SUSE-RU-2023:3956-1 |
| SLE HPC 15 SP1 | python-mysqlclient | 1.4.6-150100.3.3.7 | SUSE-RU-2023:3956-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mariadb | 10.6.4-2.1 | openSUSE-SU-2024:11038-1 |
Advisories 9
- RHSA-2009:1289 Red Hat Security Advisory: mysql security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0768 Red Hat Security Advisory: mysql security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1608-1 mysql-dfsg-5.0 - authorization bypass Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-150-1 mysql-dfsg-5.0 - authorization bypass Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-RU-2023:4991-1 Recommended update for mariadb104 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11038-1 libmariadbd-devel-10.6.4-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2023:3956-1 Recommended update for mariadb104 SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2008:0505 Red Hat Security Advisory: Red Hat Application Stack v2.1 security and enhancement update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0510 Red Hat Security Advisory: Red Hat Application Stack v1.3 security and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-60.html
- SUSE-SR:2008:017 vendor-advisory
- USN-671-1 vendor-advisory
- mysql-myisam-security-bypass(42267) vdb-entry
- 1019995 vdb-entry
- 31681 vdb-entry
- 31687 third-party-advisory
- oval:org.mitre.oval:def:10133 vdb-entry signature
- 31226 third-party-advisory
- RHSA-2009:1289 vendor-advisory
- http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html
- RHSA-2008:0768 vendor-advisory
- 30134 third-party-advisory
- 32769 third-party-advisory
- APPLE-SA-2009-09-10-2 vendor-advisory
- MDVSA-2008:149 vendor-advisory
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-24.html
- 32222 third-party-advisory
- ADV-2008-1472 vdb-entry
- 31066 third-party-advisory
- http://support.apple.com/kb/HT3865
- http://dev.mysql.com/doc/refman/6.0/en/news-6-0-5.html
- 36701 third-party-advisory
- RHSA-2008:0505 vendor-advisory
- ADV-2008-2780 vdb-entry
- 29106 vdb-entry
- RHSA-2008:0510 vendor-advisory
- http://bugs.mysql.com/bug.php?id=32167
- MDVSA-2008:150 vendor-advisory
- DSA-1608 vendor-advisory
- 36566 third-party-advisory
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216