-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Package: mysql-client-5.0
Version: 5.0.51a-24
Severity: grave
Tags: security
Justification: cross-site scripting vulnerability
Upstream is tracking a security flaw in the mysql commandline client,
identified as CVE-2008-4456:
http://bugs.mysql.com/bug.php?id=27884
Quoth http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4456 :
> Cross-site scripting (XSS) vulnerability in the command-line client in MySQL
> 5.0.26 through 5.0.45, and other versions including versions later than
> 5.0.45, when the --html option is enabled, allows attackers to inject
> arbitrary web script or HTML by placing it in a database cell, which might
> be accessed by this client when composing an HTML document. NOTE: as of
> 20081031, the issue has not been fixed in MySQL 5.0.67.
If you fix the vulnerability, please note the CVE id in your changelog entry.
- --
Devin \ aqua(at)devin.com, IRC:Requiem; http://www.devin.com
Carraway \ 1024D/E9ABFCD2: 13E7 199E DD1E 65F0 8905 2E43 5395 CA0D E9AB FCD2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFJ+VGXU5XKDemr/NIRAhDtAKC464xn8ikZ1HvT8d5PvXa+zyDU9ACguHG6
EGzZJiQwv8jOwIV2NA6OSuc=
=lRae
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
