PR/33616 CVS commit: pkgsrc/databases

[Stoned Elipot <seb%netbsd.org@localhost>]

The following reply was made to PR pkg/33616; it has been noted by GNATS.

From: Stoned Elipot <seb%netbsd.org@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: PR/33616 CVS commit: pkgsrc/databases
Date: Mon, 19 Jun 2006 07:53:00 +0000 (UTC)

 Module Name:   pkgsrc
 Committed By:  seb
 Date:          Mon Jun 19 07:53:00 UTC 2006
 
 Modified Files:
        pkgsrc/databases/mysql4-client: Makefile.common distinfo
        pkgsrc/databases/mysql4-server: distinfo
 Added Files:
        pkgsrc/databases/mysql4-client/patches: patch-bd patch-be
        pkgsrc/databases/mysql4-server/patches: patch-bd patch-be
 
 Log Message:
 Update mysql4-client and mysql4-server to version 4.1.20.
 
 Most notably this version includes fixes for
 http://secunia.com/advisories/20365/
 and
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2006-0903
 
 The fix for the latter was provided in PR pkg/33616 by Cedric
 Devillers, cedric dot devillers at script dottt univ-paris7 dot fr,
 and is not part of the upstream version 4.1.20.
 
 * Changes since last packaged version (4.1.19)
 (see http://dev.mysql.com/doc/refman/4.1/en/news-4-1-20.html for me details):
 
 This is a security fix release for the previous production release
 family.  This release includes the security fix described later in
 this section and a few other changes to resolve build problems,
 relative to the last official MySQL release (4.1.19).
 
 Bugs fixed:
 - Security fix: An SQL-injection security hole has been found in
 multi-byte encoding processing. The bug was in the server, incorrectly
 parsing the string escaped with the mysql_real_escape_string() C
 API function. (CVE-2006-2753, Bug#8378)
  This vulnerability was discovered and reported by Josh Berkus
  <josh%postgresql.org@localhost> and Tom Lane <tgl%sss.pgh.pa.us@localhost> as 
part of
  the inter-project security collaboration of the OSDB consortium.
 - The patch for Bug#8303 broke the fix for Bug#8378 and was undone.
 (In string literals with an escape character (\) followed by a
 multi-byte character that has a second byte of (\), the literal
 was not interpreted correctly. The next byte now is escaped, not
 the entire multi-byte character. This means it a strict reverse of
 the mysql_real_escape_string() function.)
 - The client libraries had not been compiled for position-indpendent
 code on Solaris-SPARC and AMD x86_64 platforms. (Bug#13159, Bug#14202,
 Bug#18091)
 - Running myisampack followed by myisamchk with the --unpack option
 would corrupt the auto_increment key. (Bug#12633)
 
 
 To generate a diff of this commit:
 cvs rdiff -r1.52 -r1.53 pkgsrc/databases/mysql4-client/Makefile.common
 cvs rdiff -r1.25 -r1.26 pkgsrc/databases/mysql4-client/distinfo
 cvs rdiff -r0 -r1.1 pkgsrc/databases/mysql4-client/patches/patch-bd \
     pkgsrc/databases/mysql4-client/patches/patch-be
 cvs rdiff -r1.23 -r1.24 pkgsrc/databases/mysql4-server/distinfo
 cvs rdiff -r0 -r1.1 pkgsrc/databases/mysql4-server/patches/patch-bd \
     pkgsrc/databases/mysql4-server/patches/patch-be
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.