CVE-2008-4098: Canonical Ubuntu Linux

Medium severity, CVSS 4.6. EPSS: 1.6% chance of exploitation in the next 30 days.

MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 7.10 only; version 8.04 only; version 8.10 only; version 9.04 only; version 9.10 only
• Debian Debian Linux: version 5.0 only
• MySQL MySQL: version 5.0.0 only; version 5.0.1 only; version 5.0.2 only; version 5.0.3 only; version 5.0.4 only; version 5.0.5 only; …
• Oracle MySQL: version 5.0.23 only; version 5.0.25 only; version 5.0.26 only; version 5.0.28 only; version 5.0.30 only; version 5.0.32 only; …

Published 2008-09-18. Last modified 2026-06-16.