| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
databases/mysql5-{client,server} security fixes.
Revisions pulled up:
- databases/mysql5-client/Makefile.common 1.41
- databases/mysql5-client/distinfo 1.30
- databases/mysql5-client/patches/patch-ad 1.8
- databases/mysql5-client/patches/patch-af 1.9
- databases/mysql5-server/PLIST 1.17
- databases/mysql5-server/distinfo 1.26
- databases/mysql5-server/patches/patch-aa 1.7
- databases/mysql5-server/patches/patch-ag 1.9
- databases/mysql5-server/patches/patch-ah 1.8
---
Module Name: pkgsrc
Module Name: pkgsrc
Committed By: taca
Date: Sat Feb 26 02:58:56 UTC 2011
Modified Files:
pkgsrc/databases/mysql5-client: Makefile.common distinfo
pkgsrc/databases/mysql5-client/patches: patch-ad patch-af
pkgsrc/databases/mysql5-server: PLIST distinfo
pkgsrc/databases/mysql5-server/patches: patch-aa patch-ag patch-ah
Log Message:
Update mysql5-{client,server} pacakge to 5.0.92.
Functionality added or changed:
* The time zone tables available at
http://dev.mysql.com/downloads/timezones.html have been
updated. These tables can be used on systems such as Windows or
HP-UX that do not include zoneinfo files. (Bug#40230)
Bugs fixed:
* Security Fix: During evaluation of arguments to extreme-value
functions (such as LEAST() and GREATEST()), type errors did not
propagate properly, causing the server to crash. (Bug#55826,
CVE-2010-3833)
* Security Fix: The server could crash after materializing a derived
table that required a temporary table for grouping. (Bug#55568,
CVE-2010-3834)
* Security Fix: A user-variable assignment expression that is
evaluated in a logical expression context can be precalculated in a
temporary table for GROUP BY. However, when the expression value is
used after creation of the temporary table, it was re-evaluated, not
read from the table and a server crash resulted. (Bug#55564,
CVE-2010-3835)
* Security Fix: Joins involving a table with a unique SET column could
cause a server crash. (Bug#54575, CVE-2010-3677)
* Security Fix: Pre-evaluation of LIKE predicates during view
preparation could cause a server crash. (Bug#54568, CVE-2010-3836)
* Security Fix: GROUP_CONCAT() and WITH ROLLUP together could cause a
server crash. (Bug#54476, CVE-2010-3837)
* Security Fix: Queries could cause a server crash if the GREATEST()
or LEAST() function had a mixed list of numeric and LONGBLOB
arguments, and the result of such a function was processed using an
intermediate temporary table. (Bug#54461, CVE-2010-3838)
* Security Fix: Using EXPLAIN with queries of the form SELECT
... UNION ... ORDER BY (SELECT ... WHERE ...) could cause a server
crash. (Bug#52711, CVE-2010-3682)
* InnoDB Storage Engine: Creating or dropping a table with 1023
transactions active caused an assertion failure. (Bug#49238)
* The make_binary_distribution target to make could fail on some
platforms because the lines generated were too long for the
shell. (Bug#54590)
* A client could supply data in chunks to a prepared statement
parameter other than of type TEXT or BLOB using the
mysql_stmt_send_long_data() C API function (or
COM_STMT_SEND_LONG_DATA command). This led to a crash because other
data types are not valid for long data. (Bug#54041)
* Builds of the embedded mysqld would fail due to a missing element of
the struct NET. (Bug#53908, Bug#53912)
* The definition of the MY_INIT macro in my_sys.h included an
extraneous semicolon, which could cause compilation
failure. (Bug#53906)
* If the remote server for a FEDERATED table could not be accessed,
queries for the INFORMATION_SCHEMA.TABLES table failed. (Bug#35333)
* mysqld could fail during execution when using SSL. (Bug#34236)
* Threads that were calculating the estimated number of records for a
range scan did not respond to the KILL statement. That is, if a
range join type is possible (even if not selected by the optimizer
as a join type of choice and thus not shown by EXPLAIN), the query
in the statistics state (shown by the SHOW PROCESSLIST) did not
respond to the KILL statement. (Bug#25421)
|
|
documentation.
PKGREVISION++
|
|
Change since version 5.0.41:
- Functionality added or changed:
- A new status variable, Com_call_procedure, indicates the number of calls
to stored procedures. (Bug#27994)
- NDB Cluster: The server source tree now includes scripts to simplify
building MySQL with SCI support. For more information about SCI
interconnects and these build scripts, see Section 15.9.1,
Configuring MySQL Cluster to use SCI Sockets. (Bug#25470)
- Prior to this release, when DATE values were compared with DATETIME values
the time portion of the DATETIME value was ignored. Now a DATE value is
coerced to the DATETIME type by adding the time portion as 00:00:00. To
mimic the old behavior use the CAST() function in the following way:
SELECT date_field = CAST(NOW() as DATE);. (Bug#28929)
- A large number of bugs including these security problems have been fixed:
- A malformed password packet in the
connection protocol could cause the server to crash. Thanks for Dormando
for reporting this bug and providing details and a proof of concept.
(Bug#28984)
- CREATE TABLE LIKE did not require any privileges on the source table. Now
it requires the SELECT privilege. (Bug#25578)
- In addition, CREATE TABLE LIKE was not isolated from alteration by other
connections, which resulted in various errors and incorrect binary log
order when trying to execute concurrently a CREATE TABLE LIKE statement
and either DDL statements on the source table or DML or DDL statements on
the target table. (Bug#23667)
|
|
* Added the SHOW PROFILES and SHOW PROFILE statements to display statement
profile data, and the accompanying INFORMATION_SCHEMA.PROFILING table.
* Added the Uptime_since_flush_status status variable, which indicates the
number of seconds since the most recent FLUSH STATUS statement.
* Incompatible change in DATE_FORMAT().
* NDB Cluster: The LockPagesInMainMemory configuration parameter has changed
its type and possible values.
* The bundled yaSSL library was upgraded to version 1.5.8.
* The --skip-thread-priority option now is enabled by default for binary Mac
OS X distributions. Use of thread priorities degrades performance on Mac OS X.
* Added the --disable-grant-options option to configure.
* Bug fixes.
|
|
|
|
a problem with vulnerabilities".
Please see the following URLs for changes:
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-26.html
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
Two patches were sent upstream, I hope to get them in the next version.
|
|
Too many changes to list... more information via:
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-18.html
|
|
MySQL is a SQL (Structured Query Language) database server. SQL is the
most popular database language in the world. MySQL is a client-server
implementation that consists of a server daemon `mysqld' and many
different client programs/libraries.
The main goals of MySQL are speed and robustness.
The base upon which MySQL is built is a set of routines that have been
used in a highly demanding production environment for many years. While
MySQL is still in development it already offers a rich and highly useful
function set.
The official way to pronounce 'MySQL' is 'My Ess Que Ell' (Not MY-SEQUEL).
This package contains the MySQL client programs and libraries.
|
