Description
Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a table name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | mysql-dfsg-5.0 | 5.0.51a-24+lenny4 | DSA-2057-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mysql +4 | 5.0.77-4.el5_5.3 | RHSA-2010:0442 |
| RHEL 4 | mysql +3 | 4.1.22-2.el4_8.4 | RHSA-2010:0824 |
Advisories 3
- RHSA-2010:0824 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0442 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2057-1 mysql-dfsg-5.0 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-1397-1 vendor-advisory
- http://support.apple.com/kb/HT4435
- RHSA-2010:0824 vendor-advisory
- oval:org.mitre.oval:def:10258 vdb-entry signature
- oval:org.mitre.oval:def:7210 vdb-entry signature
- APPLE-SA-2010-11-10-1 vendor-advisory
- http://dev.mysql.com/doc/refman/5.1/en/news-5-1-47.html
- http://lists.mysql.com/commits/107532
- http://bugs.mysql.com/bug.php?id=53371
- http://dev.mysql.com/doc/refman/5.0/en/news-5-0-91.html
- RHSA-2010:0442 vendor-advisory
- SUSE-SR:2010:021 vendor-advisory
- 1024031 vdb-entry
- MDVSA-2010:107 vendor-advisory
- SUSE-SR:2010:019 vendor-advisory