From mysql ChangeLog:
An SQL-injection security hole has been found in multi-byte encoding
processing. The bug was in the server, incorrectly parsing the string
escaped with the mysql_real_escape_string() C API function. (Bug#8378)
Detailed information:
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-22.html
ok brad@
STABILITY FIX:
Fixed double free'd pointer bug in mysql_change_user() handling, that
enabled a specially hacked version of MySQL client to crash mysqld.
Note, that one needs to login to the server by using a valid user
account to be able to exploit this bug.
--
- The port has switched back to using native threads. Only tested and known to work on i386. For everything else the port is currently marked BROKEN until the appropriate architectures are tested. Do not even try this if you're not running -current libc_r.
- As suggested by Marc Espie, make symlink for the MySQL client library in lib/ to eliminate the need for adding lib/mysql to the shlib dir path. Porters have to be careful and ensure autoconf scripts do not arbitrarily enable MySQL support after this change.
