Updated MySQL packages fix various security issues

Updated MySQL packages are available for Red Hat Linux 7, 7.1, 7.2, 7.3,
and 8.0 which fix security vulnerabilities found in the MySQL server.

MySQL is a multi-user, multi-threaded SQL database server. While auditing
MySQL, Stefan Esser found security vulnerabilities that can be used to
crash the server or allow MySQL users to gain privileges.

A signed integer vulnerability in the COM_TABLE_DUMP package for MySQL
3.x to 3.23.53a allows remote attackers to cause a denial of service
(crash or hang) in mysqld by causing large negative integers to be provided
to a memcpy call. (CAN-2002-1373)

The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to
4.0.5a allows a remote attacker to gain privileges via a brute force
attack using a one-character password, which causes MySQL to only compare
the provided password against the first character of the real
password. (CAN-2002-1374)

The COM_CHANGE_USER command in MySQL 3.x to 3.23.53a and 4.x to
4.0.5a allows remote attackers to execute arbitrary code via a long
response. (CAN-2002-1375)

The MySQL client library (libmysqlclient) in MySQL 3.x to 3.23.53a and 4.x
to 4.0.5a does not properly verify length fields for certain responses
in the read_rows or read_one_row routines, which allows a malicious server
to cause a denial of service and possibly execute arbitrary
code. (CAN-2002-1376)

Red Hat Linux 7, 7.1, 7.2, 7.3, and 8.0 contain versions of MySQL that
are vulnerable to these issues. All users of MySQL are advised to upgrade
to the erratum packages containing MySQL 3.23.54a which is not vulnerable
to these issues.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

79606 - Several vulnerabilities within (lib)MySQL could allow (remote) compromise of client and/or server.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1373
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1374
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1375
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1376
http://security.e-matters.de/advisories/042002.html