Hi,
The MySQL 4.1.13 release included a fix to resolve a potential security
vulnerability in the zlib compression library (CAN-2005-2096) that is bundled
with the MySQL distribution. Very shortly afterwards, an additional potential
zlib security flaw was discovered and fixed - the issue is tracked by the Mitre
CVE ID CAN-2005-1849. However, this second fix appeared too late for inclusion
in the initial MySQL 4.1.13 release.
Even though zlib is included in the MySQL sources, most binary builds
distributed by MySQL actually are not statically linked against it by default.
On most platforms, MySQL is linked dynamically to the shared zlib library
provided by the operating system. This means that it's usually sufficient to
update the zlib library and restart MySQL to resolve this issue. Many OS
vendors have provided zlib updates by now.
For those platforms were the binaries are linked statically against zlib and
that were affected by this second vulnerabilty, we have now published updated
binaries on our download pages. The source archive was updated as well.
The MySQL binaries for the following platforms are affected and have been
updated to version 4.1.13a:
- Microsoft Windows
- HPUX 11.00/11.11 (PA/RISC)
- HPUX 11.23 (IA64)
- Mac OS X 10.4 (64bit only)
- IBM AIX 5.2/4.3
- Linux/s390
This is the same code base as the 4.1.13 release with just one additional patch
to resolve the security issue tracked by CAN-2005-1849. The source and binaries
are now available for Download from
http://dev.mysql.com/downloads/mysql/4.1.html
and mirror sites. Even though we are currently not aware of any program that is
actually capable of exploiting this zlib vulnerability within MySQL, we would
like to encourage our users to make sure they update to this version as soon as
possible.
Matt