CVE-2008-4098
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE...
CVE-2008-4098 is a medium vulnerability (CVSS 4.6) in Mysql, published September 17, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.62%, the 76th percentile. Fixed in mysql-dfsg-5.0 5.0.32-7etch8.
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
Exploit likelihood
What each source reports
NVD Score used
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
- Record
CVE-2008-4098- CVSS 2.0
- 4.6 Medium
AV:N/AC:H/Au:S/C:P/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
- Record
CVE-2008-4098- Updated
- 2026-11-02
EUVDEUVD-2008-4082 No score
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
- Record
EUVD-2008-4082- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cwr2-c5mc-rxv6 No score
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE...
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
- Record
GHSA-cwr2-c5mc-rxv6- Weakness
- CWE-59
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql-dfsg-5.0Debian:4.0 |
before 5.0.32-7etch8, plus listed versions 5.0.32-7etch15.0.32-7etch35.0.32-7etch3~bpo31+15.0.32-7etch45.0.32-7etch55.0.32-7etch5~bpo31+15.0.32-7etch6 |
5.0.32-7etch8 |
httpdRed Hat:rhel_application_stack:2 |
before 0:2.2.11-2.el5s2 | 0:2.2.11-2.el5s2 |
httpd-debuginfoRed Hat:rhel_application_stack:2 |
before 0:2.2.11-2.el5s2 | 0:2.2.11-2.el5s2 |
httpd-develRed Hat:rhel_application_stack:2 |
before 0:2.2.11-2.el5s2 | 0:2.2.11-2.el5s2 |
httpd-manualRed Hat:rhel_application_stack:2 |
before 0:2.2.11-2.el5s2 | 0:2.2.11-2.el5s2 |
mod_jkRed Hat:rhel_application_stack:2 |
before 0:1.2.28-2.el5s2 | 0:1.2.28-2.el5s2 |
mod_jk-ap20Red Hat:rhel_application_stack:2 |
before 0:1.2.28-2.el5s2 | 0:1.2.28-2.el5s2 |
mod_jk-debuginfoRed Hat:rhel_application_stack:2 |
before 0:1.2.28-2.el5s2 | 0:1.2.28-2.el5s2 |
mod_sslRed Hat:rhel_application_stack:2 |
before 1:2.2.11-2.el5s2 | 1:2.2.11-2.el5s2 |
mysqlRed Hat:rhel_application_stack:2 |
before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
Show 70 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mysql-benchRed Hat:rhel_application_stack:2 |
before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-clusterRed Hat:rhel_application_stack:2 |
before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-connector-odbcRed Hat:rhel_application_stack:2 |
before 0:3.51.27r695-1.el5s2 | 0:3.51.27r695-1.el5s2 |
mysql-connector-odbc-debuginfoRed Hat:rhel_application_stack:2 |
before 0:3.51.27r695-1.el5s2 | 0:3.51.27r695-1.el5s2 |
mysql-debuginfoRed Hat:rhel_application_stack:2 |
before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-develRed Hat:rhel_application_stack:2 |
before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-libsRed Hat:rhel_application_stack:2 |
before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-serverRed Hat:rhel_application_stack:2 |
before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-testRed Hat:rhel_application_stack:2 |
before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
perl-DBD-MySQLRed Hat:rhel_application_stack:2 |
before 0:4.010-1.el5s2 | 0:4.010-1.el5s2 |
perl-DBD-MySQL-debuginfoRed Hat:rhel_application_stack:2 |
before 0:4.010-1.el5s2 | 0:4.010-1.el5s2 |
perl-DBD-PgRed Hat:rhel_application_stack:2 |
before 0:1.49-5.el5s2 | 0:1.49-5.el5s2 |
perl-DBD-Pg-debuginfoRed Hat:rhel_application_stack:2 |
before 0:1.49-5.el5s2 | 0:1.49-5.el5s2 |
phpRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-bcmathRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-cliRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-commonRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-dbaRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-debuginfoRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-develRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-gdRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-imapRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-ldapRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-mbstringRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-mysqlRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-ncursesRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-odbcRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-pdoRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-pgsqlRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-snmpRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-soapRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-xmlRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-xmlrpcRed Hat:rhel_application_stack:2 |
before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
postgresqlRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-contribRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-debuginfoRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-develRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-docsRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-jdbcRed Hat:rhel_application_stack:2 |
before 0:8.2.509-2jpp.el5s2 | 0:8.2.509-2jpp.el5s2 |
postgresql-jdbc-debuginfoRed Hat:rhel_application_stack:2 |
before 0:8.2.509-2jpp.el5s2 | 0:8.2.509-2jpp.el5s2 |
postgresql-libsRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-plperlRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-plpythonRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-pltclRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-pythonRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-serverRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-tclRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-testRed Hat:rhel_application_stack:2 |
before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresqlclient81Red Hat:rhel_application_stack:2 |
before 0:8.1.17-1.el5s2 | 0:8.1.17-1.el5s2 |
postgresqlclient81-debuginfoRed Hat:rhel_application_stack:2 |
before 0:8.1.17-1.el5s2 | 0:8.1.17-1.el5s2 |
mysqlRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-benchRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-debuginfoRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-develRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-serverRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysqlRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-benchRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-develRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-serverRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysqlRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-benchRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-debuginfoRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-develRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-serverRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysqlRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-benchRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-develRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
mysql-serverRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4_8.3 | 0:4.1.22-2.el4_8.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
mandriva.com/security/advisories?name=MDVSA-2009:094
ubuntu.com/usn/USN-1397-1
redhat.com/support/errata/RHSA-2009-1067.html
bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292
secunia.com/advisories/38517
Show 51 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10591
ubuntu.com/usn/usn-897-1
openwall.com/lists/oss-security/2008/09/09/20
exchange.xforce.ibmcloud.com/vulnerabilities/45649
debian.org/security/2008/dsa-1662
bugs.mysql.com/bug.php?id=32167
lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
nvd.nist.gov/vuln/detail/CVE-2008-4098
github.com/advisories/GHSA-cwr2-c5mc-rxv6
access.redhat.com/errata/RHSA-2009:1067
bugzilla.redhat.com/show_bug.cgi?id=454077
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1067.json
cve.org/CVERecord?id=CVE-2008-3963
dev.mysql.com/doc/refman/4.1/en/symbolic-links-to-tables.html