Description

Ubuntu has issued an update for mysql-dfsg-5 and mysql-dfsg-5.1. This fixes some security issues and vulnerabilities, which can be exploited by local users to bypass certain security restrictions, by malicious users to bypass certain security restrictions and cause a DoS (Denial of Service), and by malicious people to conduct cross-site scripting attacks, cause a DoS, and potentially compromise a vulnerable system.

For more information:
SA30134
SA32072
SA35767
SA37372
SA38364

1) A security issue is caused due to the application checking the validity of a local path by using a requested table name without extension. This can be exploited to bypass table access restrictions in CREATE TABLE statements via symlink attacks.

This is related to:
SA30134

Note: CVE-2008-4098 only affects Ubuntu 8.10, CVE-2008-4456 and CVE-2009-2446 only affect Ubuntu 6.06 LTS, 8.04 LTS, 8.10, and 9.04, and CVE-2008-7247 only affects Ubuntu 9.10. CVE-2009-4484 can only be exploited to cause a DoS in Ubuntu 6.06 LTS.

Solution
Apply updated packages.
Further details available in Customer Area

Original Advisory
USN-897-1:
https://lists.ubuntu.com/archives/ubuntu-security-announce/2010-February/001042.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area