CVE-2008-2079: Canonical Ubuntu Linux

Medium severity, CVSS 4.6. EPSS: 2.6% chance of exploitation in the next 30 days.

MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL home data directory, which can point to tables that are created in the future.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 7.10 only; version 8.04 only
• Debian Debian Linux: version 4.0 only
• MySQL MySQL: from 4.1.0, before 4.1.24 (fixed in 4.1.24); from 5.0.0, before 5.0.60 (fixed in 5.0.60); from 5.1.0, before 5.1.24 (fixed in 5.1.24)
• Oracle MySQL: from 6.0.0, before 6.0.5 (fixed in 6.0.5)

Published 2008-05-05. Last modified 2026-06-16.