CVE catalog

CVE-2008-4098

mysql-dfsg-5.0 - authorization bypass

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.62% · Oct 25, 2026

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097. mysql: incomplete upstream fix for CVE-2008-2079 In Red Hat Enterprise Linux 5, issue CVE-2008-2079 was fixed without introducing CVE-2008-4098 in RHSA-2009:1289. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmysql-dfsg-5.04.05.0.32-7etch1vulnerable
Debianmysql-dfsg-5.04.05.0.32-7etch3vulnerable
Debianmysql-dfsg-5.04.05.0.32-7etch3~bpo31+1vulnerable
Debianmysql-dfsg-5.04.05.0.32-7etch4vulnerable
Debianmysql-dfsg-5.04.05.0.32-7etch5vulnerable
Debianmysql-dfsg-5.04.05.0.32-7etch5~bpo31+1vulnerable
Debianmysql-dfsg-5.04.05.0.32-7etch6vulnerable
Debianmysql-dfsg-5.04.05.0.32-7etch8fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmysql-dfsg-5.0deb4.05.0.32-7etch8Not reportedDSA-1662-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]