CVE-2006-4227
NoneCVSS
—
EPSS
13.6%
Published
Aug 18, 2006
CISA due date
—
The record
MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:enterprise_linux:5::client | mysql | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client | mysql-bench | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client | mysql-debuginfo | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client | mysql-devel | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client | mysql-server | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client | mysql-test | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | mysql | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-bench | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-debuginfo | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-devel | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-server | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-test | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::server | mysql | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::server | mysql-bench | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::server | mysql-debuginfo | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::server | mysql-devel | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::server | mysql-server | 0 | 0:5.0.45-7.el5 |
| Red Hat:enterprise_linux:5::server | mysql-test | 0 | 0:5.0.45-7.el5 |
| Red Hat:rhel_application_stack:1 | mysql | 0 | 0:5.0.30-1.el4s1.1 |
| Red Hat:rhel_application_stack:1 | mysql-bench | 0 | 0:5.0.30-1.el4s1.1 |
| Red Hat:rhel_application_stack:1 | mysql-debuginfo | 0 | 0:5.0.30-1.el4s1.1 |
| Red Hat:rhel_application_stack:1 | mysql-devel | 0 | 0:5.0.30-1.el4s1.1 |
| Red Hat:rhel_application_stack:1 | mysql-server | 0 | 0:5.0.30-1.el4s1.1 |
| Red Hat:rhel_application_stack:1 | mysql-test | 0 | 0:5.0.30-1.el4s1.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Server 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Server 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Server 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Server 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
Related vulnerabilities
- CVE-2010-3681 Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to… Also affects mysql
- CVE-2010-3680 Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of… Also affects mysql
- CVE-2010-3682 Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to… Also affects mysql
- CVE-2010-1850 Buffer overflow in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote… Also affects mysql
- CVE-2009-4019 mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle… Also affects mysql
- CVE-2009-2446 Multiple format string vulnerabilities in the dispatch_command function in… Also affects mysql
- CVE-2007-5969 MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server… Also affects mysql
- CVE-2007-5925 The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in… Also affects mysql