Re: MySQL 0-day - does it need a CVE?

[Tomas Hoger <thoger () redhat com>]

On Thu, 09 Feb 2012 10:20:14 -0700 Kurt Seifried wrote:

> https://lists.immunityinc.com/pipermail/canvas/2012-February/000011.html

...

> We are releasing a working MySQL 5.5.20 remote 0day exploit with this
> update.The exploit has been tested with
> mysql-5.5.20-debian6.0-i686.deb on Debian 6.0.

Note also:

https://lists.immunityinc.com/pipermail/canvas/2012-February/000014.html
http://partners.immunityinc.com/movies/VD-MySQL-5_5_20.mov

According to the video, it should be "yassl buffer overflow".

-- 
Tomas Hoger / Red Hat Security Response Team