MySQL 3.23.58 has been released

[Lenz Grimmer]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

MySQL 3.23.58, a new version of the popular Open Source/Free Software
Database, has been released. It is now available in source and binary form
for a number of platforms from our download pages at
http://www.mysql.com/downloads/ and mirror sites.

Note that not all mirror sites may be up to date at this point in time -
if you can't find this version on some mirror, please try again later or
choose another download site.

This is a bugfix release for the recent production version. It includes a
fix for a potential local security vulnerability which has already been
applied to MySQL 4.0.15 as well.

Please refer to our bug database at http://bugs.mysql.com/ for more
details about the individual bugs fixed in this version.

News from the ChangeLog:

* Fixed buffer overflow in password handling which could potentially
be exploited by MySQL users with `ALTER' privilege on the
`mysql.user' table to execute random code or to gain shell access
with the UID of the mysqld process (thanks to Jedi/Sector One for
spotting and reporting this bug).

* `mysqldump' now correctly quotes all identifiers when communicating
with the server. This assures that during the dump process,
`mysqldump' will never send queries to the server that result in a
syntax error. This problem is *not* related to the `mysqldump'
program's output, which was not changed. (Bug #1148)

* Fixed table/column grant handling - proper sort order (from most
specific to less specific, *note Request access::) was not
honored. (Bug #928)

* Fixed overflow bug in `MyISAM' and `ISAM' when a row is updated in
a table with a large number of columns and at least one `BLOB/TEXT'
column.

* Fixed MySQL so that field length (in C API) for the second column
in `SHOW CREATE TABLE' is always larger than the data length. The
only known application that was affected by the old behaviour was
Borland dbExpress, which truncated the output from the command.
(Bug #1064)

* Fixed `ISAM' bug in `MAX()' optimisation.

* Fixed `Unknown error' when doing `ORDER BY' on reference table
which was used with `NULL' value on `NOT NULL' column. (Bug #479)

Bye,
LenZ
- --
Lenz Grimmer <***@mysql.com>
Senior Production Engineer
MySQL GmbH, http://www.mysql.de/
Hamburg, Germany

For technical support contracts, visit https://order.mysql.com/?ref=mlgr
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: For info see http://quantumlab.net/pine_privacy_guard/

iD8DBQE/Ze5NSVDhKrJykfIRAjdyAJ9eg1CTafcFv+U8W9GwcCPpU7m1XQCeMSCp
xo6EMYY1Ixk81fveHOC+OQc=
=UuFh
-----END PGP SIGNATURE-----

[Dan Anderson]

Wasn't there just an announcement that 4.0.something was released?

-Dan

Post by Lenz Grimmer
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
MySQL 3.23.58, a new version of the popular Open Source/Free Software
Database, has been released. It is now available in source and binary form
for a number of platforms from our download pages at
http://www.mysql.com/downloads/ and mirror sites.
Note that not all mirror sites may be up to date at this point in time -
if you can't find this version on some mirror, please try again later or
choose another download site.
This is a bugfix release for the recent production version. It includes a
fix for a potential local security vulnerability which has already been
applied to MySQL 4.0.15 as well.
Please refer to our bug database at http://bugs.mysql.com/ for more
details about the individual bugs fixed in this version.
* Fixed buffer overflow in password handling which could potentially
be exploited by MySQL users with `ALTER' privilege on the
`mysql.user' table to execute random code or to gain shell access
with the UID of the mysqld process (thanks to Jedi/Sector One for
spotting and reporting this bug).
* `mysqldump' now correctly quotes all identifiers when communicating
with the server. This assures that during the dump process,
`mysqldump' will never send queries to the server that result in a
syntax error. This problem is *not* related to the `mysqldump'
program's output, which was not changed. (Bug #1148)
* Fixed table/column grant handling - proper sort order (from most
specific to less specific, *note Request access::) was not
honored. (Bug #928)
* Fixed overflow bug in `MyISAM' and `ISAM' when a row is updated in
a table with a large number of columns and at least one `BLOB/TEXT'
column.
* Fixed MySQL so that field length (in C API) for the second column
in `SHOW CREATE TABLE' is always larger than the data length. The
only known application that was affected by the old behaviour was
Borland dbExpress, which truncated the output from the command.
(Bug #1064)
* Fixed `ISAM' bug in `MAX()' optimisation.
* Fixed `Unknown error' when doing `ORDER BY' on reference table
which was used with `NULL' value on `NOT NULL' column. (Bug #479)
Bye,
LenZ
- --
Senior Production Engineer
MySQL GmbH, http://www.mysql.de/
Hamburg, Germany
For technical support contracts, visit https://order.mysql.com/?ref=mlgr
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: For info see http://quantumlab.net/pine_privacy_guard/
iD8DBQE/Ze5NSVDhKrJykfIRAjdyAJ9eg1CTafcFv+U8W9GwcCPpU7m1XQCeMSCp
xo6EMYY1Ixk81fveHOC+OQc=
=UuFh
-----END PGP SIGNATURE-----

[Paul DuBois]

Post by Dan Anderson
Wasn't there just an announcement that 4.0.something was released?

Yes, 4.0.15.

There are 3.23, 4.0, 4.1, and 5.0 development trees, each at different
stages of their lifetime.
--
Paul DuBois, Senior Technical Writer
Madison, Wisconsin, USA
MySQL AB, www.mysql.com

Are you MySQL certified? http://www.mysql.com/certification/

[Dan Anderson]

Post by Paul DuBois
There are 3.23, 4.0, 4.1, and 5.0 development trees, each at different
stages of their lifetime.

Is there any reason not to use 4.0.15 and instead use 3.23 in a
production environment? I know MAX is unstable but I have 4.0.15
installed.

-Dan

[Jeremy Zawodny]

Post by Dan Anderson

Post by Paul DuBois
There are 3.23, 4.0, 4.1, and 5.0 development trees, each at different
stages of their lifetime.

Is there any reason not to use 4.0.15 and instead use 3.23 in a
production environment? I know MAX is unstable but I have 4.0.15
installed.

Well, some organizations are more cautious approach to upgrades.
--
Jeremy D. Zawodny | Perl, Web, MySQL, Linux Magazine, Yahoo!
<***@Zawodny.com> | http://jeremy.zawodny.com/

MySQL 4.0.15-Yahoo-SMP: up 1 days, processed 58,542,256 queries (388/sec. avg)

[Rob A. Brahier]

It is a good idea to stick with the MySQL branch that you currently use in
production. The only reasons I can see to do otherwise are 1) if you need a
feature introduced in one of the newer development trees or 2) if your
project is in its early stages and you want to avoid the hassle of upgrading
later. There are several changes between 3.23.x and 4.0.x that could
require you to modify/upgrade your MySQL-enabled apps. You can avoid most
of them by keeping up with the change-log for the dev tree branch that comes
after yours (4.0.x if you use 3.23.x, 4.1.x if you're using 4.0.x, etc.)and
writing your apps with those changes in mind.

Personally, I have some production servers running 3.23.x and some running
4.0.x versions of MySQL. Neither version has given me a problem. There's
my two cents. ;)

-Rob

-----Original Message-----
From: Jeremy Zawodny [mailto:***@Zawodny.com]
Sent: Monday, September 15, 2003 2:08 PM
To: Dan Anderson
Cc: Paul DuBois; ***@lists.mysql.com
Subject: Re: MySQL 3.23.58 has been released

Post by Dan Anderson

Post by Paul DuBois
There are 3.23, 4.0, 4.1, and 5.0 development trees, each at different
stages of their lifetime.

Is there any reason not to use 4.0.15 and instead use 3.23 in a
production environment? I know MAX is unstable but I have 4.0.15
installed.

Well, some organizations are more cautious approach to upgrades.
--
Jeremy D. Zawodny | Perl, Web, MySQL, Linux Magazine, Yahoo!
<***@Zawodny.com> | http://jeremy.zawodny.com/

MySQL 4.0.15-Yahoo-SMP: up 1 days, processed 58,542,256 queries (388/sec.
avg)