From ${URL} : Alyssa Milburn reported that when MySQL attempts to convert a binary string representation of a raw geometry object to a textual representation, the length checks in MySQL's spatial functions would overflow, resulting in a crash of mysqld (for instance, a query like "select astext(0x0100000000030000000100000000000010);" will cause the crash). This has been reported to both upstream MariaDB [1] and Oracle [2]. A proposed patch is available [3]. [1] https://mariadb.atlassian.net/browse/MDEV-4252 [2] http://bugs.mysql.com/bug.php?id=68591 [3] http://lists.askmonty.org/pipermail/commits/2013-March/004371.html
Upstream patch as of 2013/03/15 does NOT fix all the issues, see the comments on [1].
5.5.31 will have further fixes for this. See http://lists.askmonty.org/pipermail/commits/2013-March/004447.html
*** Bug 462222 has been marked as a duplicate of this bug. ***
CVE-2013-1861 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1861): MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and unspecified versions of Oracle MySQL, allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
This issue is noted as being corrected in the Oracle July 2013 CPU: http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html#AppendixMSQL It is reported to be fixed in 5.6.12, 5.5.32, and 5.1.70. @security, go ahead with the glsa.
GLSA request filed
This issue was resolved and addressed in GLSA 201409-04 at http://security.gentoo.org/glsa/glsa-201409-04.xml by GLSA coordinator Sergey Popov (pinkbyte).