A vulnerability has been reported in MySQL Connector/J, which can potentially be exploited by malicious people to conduct SQL injection attacks.

The vulnerability is caused due to an error when processing a query string containing certain unicode characters. This can potentially be exploited to manipulate SQL queries by injecting arbitrary SQL code in an application using this package.

Successful exploitation requires that a certain character set is used, e.g. SJIS/Windows-31J.

The vulnerability is reported in version 5.1.7. Prior versions may also be affected.

Solution
Update to version 5.1.8.

Provided and/or discovered by
Reported in a MySQL bug entry by Sadao Hiratsuka.

Original Advisory
http://dev.mysql.com/doc/refman/5.1/en/cj-news-5-1-8.html
http://bugs.mysql.com/bug.php?id=41730

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area