[debian-mysql] Bug#841050: Bug#841050: Security fixes from the October 2016 CPU
lars.tangvald at oracle.com
Mon Oct 17 09:31:24 UTC 2016
As noted in the changelog for 5.5.53 at
MySQL 5.5.53 contains a change that requires packaging changes and could
potentially impact users:
By default the server will restrict the server's access for SELECT INTO
OUTFILE and LOAD DATA operations to /var/lib/mysql-files, and requires
the directory to be present at startup.
This behavior can be changed at build-time to either turn such access
off completely or make it unrestricted (current behavior).
We strongly recommend keeping the default behavior to improve the
default security, i.e. change packaging to create the mysql-files
directory. We're not aware of any other packages that rely on this
functionality, but there is a risk of this change disrupting user workflows.
On 10/17/2016 10:05 AM, Norvald H. Ryeng wrote:
> Source: mysql-5.5
> Version: 5.5.52-0+deb8u1
> Severity: grave
> Tags: security upstream fixed-upstream
> The Oracle Critical Patch Update for October 2016 will be released on
> Tuesday, October 18. According to the pre-release announcement , it
> will contain information about CVEs fixed in MySQL 5.5.53.
> The CVE numbers will be available when the CPU is released.
> Norvald H. Ryeng
> pkg-mysql-maint mailing list
> pkg-mysql-maint at lists.alioth.debian.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the pkg-mysql-maint