-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello,
The MySQL 4.1.13 release included a fix to resolve a potential security vulnerability in the zlib compression library (CAN-2005-2096) that is bundled with the MySQL distribution. Very shortly afterwards, an additional potential zlib security flaw was discovered and fixed - the issue is tracked by the Mitre CVE ID CAN-2005-1849. However, this second fix appeared too late for inclusion in the initial MySQL 4.1.13 release. Even though zlib is included in the MySQL sources, most binary builds distributed by MySQL actually are not statically linked against it by default. On most platforms, MySQL is linked dynamically to the shared zlib library provided by the operating system. This means that it's usually sufficient to update the zlib library and restart MySQL to resolve this issue. Many OS vendors have provided zlib updates by now. For those platforms were the binaries are linked statically against zlib and that were affected by this second vulnerabilty, we have now published updated binaries on our download pages. The source archive was updated as well. The MySQL binaries for the following platforms are affected and have been updated to version 4.1.13a: - Microsoft Windows - HPUX 11.00/11.11 (PA/RISC) - HPUX 11.23 (IA64) - Mac OS X 10.4 (64bit only) - IBM AIX 5.2/4.3 - Linux/s390 This is the same code base as the 4.1.13 release with just one additional patch to resolve the security issue tracked by CAN-2005-1849. The source and binaries are now available for Download from http://dev.mysql.com/downloads/mysql/4.1.html and mirror sites. Even though we are currently not aware of any program that is actually capable of exploiting this zlib vulnerability within MySQL, we would like to encourage our users to make sure they update to this version as soon as possible. Bye, LenZ - -- Lenz Grimmer <[EMAIL PROTECTED]> Senior Production Engineer MySQL GmbH, http://www.mysql.de/ Hamburg, Germany Are you MySQL certified? http://www.mysql.com/certification/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: For info see http://quantumlab.net/pine_privacy_guard/ iD8DBQFC8m7lSVDhKrJykfIRAnQBAJ0VL9oULqKWsp7DW7MChM3gqAGOuACfQq+N ePZqTR4/+IGMT6dOXqzLq2Y= =SI7n -----END PGP SIGNATURE----- -- MySQL General Mailing List For list archives: http://lists.mysql.com/mysql To unsubscribe: http://lists.mysql.com/[EMAIL PROTECTED]
