CVE-2006-4226
MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive...
3.6 LowFix available
CVE-2006-4226 is a low vulnerability (CVSS 3.6) in Mysql, published August 18, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.07%, the 87th percentile. Fixed in mysql 0:4.1.20-2.RHEL4.1.
- Severity
- 3.6 LowCVSS 2.0, NVD
- Exploit chance
- 3.07%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0:4.1.20-2.RHEL4.1mysql +45 more
Description
MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.
Exploit likelihood
3.07%Up 0.8 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql-dfsg-4.1Debian:3.1 From an advisory covering 2 CVEs | before 4.1.11a-4sarge7, plus listed versions 4.1.11a-44.1.11a-4sarge14.1.11a-4sarge24.1.11a-4sarge34.1.11a-4sarge44.1.11a-4sarge5 | 4.1.11a-4sarge7 |
mysqlRed Hat:rhel_application_stack:1 From an advisory covering 5 CVEs | before 0:5.0.30-1.el4s1.1 | 0:5.0.30-1.el4s1.1 |
mysql-benchRed Hat:rhel_application_stack:1 From an advisory covering 5 CVEs | before 0:5.0.30-1.el4s1.1 | 0:5.0.30-1.el4s1.1 |
mysql-debuginfoRed Hat:rhel_application_stack:1 From an advisory covering 5 CVEs | before 0:5.0.30-1.el4s1.1 | 0:5.0.30-1.el4s1.1 |
mysql-develRed Hat:rhel_application_stack:1 From an advisory covering 5 CVEs | before 0:5.0.30-1.el4s1.1 | 0:5.0.30-1.el4s1.1 |
mysql-serverRed Hat:rhel_application_stack:1 From an advisory covering 5 CVEs | before 0:5.0.30-1.el4s1.1 | 0:5.0.30-1.el4s1.1 |
mysql-testRed Hat:rhel_application_stack:1 From an advisory covering 5 CVEs | before 0:5.0.30-1.el4s1.1 | 0:5.0.30-1.el4s1.1 |
mysqlRed Hat:enterprise_linux:4::as | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-benchRed Hat:enterprise_linux:4::as | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-debuginfoRed Hat:enterprise_linux:4::as | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mysql-develRed Hat:enterprise_linux:4::as | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-serverRed Hat:enterprise_linux:4::as | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysqlRed Hat:enterprise_linux:4::desktop | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-benchRed Hat:enterprise_linux:4::desktop | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-debuginfoRed Hat:enterprise_linux:4::desktop | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-develRed Hat:enterprise_linux:4::desktop | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-serverRed Hat:enterprise_linux:4::desktop | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysqlRed Hat:enterprise_linux:4::es | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-benchRed Hat:enterprise_linux:4::es | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-debuginfoRed Hat:enterprise_linux:4::es | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-develRed Hat:enterprise_linux:4::es | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-serverRed Hat:enterprise_linux:4::es | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysqlRed Hat:enterprise_linux:4::ws | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-benchRed Hat:enterprise_linux:4::ws | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-debuginfoRed Hat:enterprise_linux:4::ws | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-develRed Hat:enterprise_linux:4::ws | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mysql-serverRed Hat:enterprise_linux:4::ws | before 0:4.1.20-2.RHEL4.1 | 0:4.1.20-2.RHEL4.1 |
mariadb104SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 221 CVEs | before 10.4.30-150100.3.5.10 | 10.4.30-150100.3.5.10 |
python-mysqlclientSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 221 CVEs | before 1.4.6-150100.3.3.7 | 1.4.6-150100.3.3.7 |
mariadb104SUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 221 CVEs | before 10.4.30-150100.3.5.10 | 10.4.30-150100.3.5.10 |
python-mysqlclientSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 221 CVEs | before 1.4.6-150100.3.3.7 | 1.4.6-150100.3.3.7 |
mariadb104SUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 221 CVEs | before 10.4.30-150100.3.5.10 | 10.4.30-150100.3.5.10 |
python-mysqlclientSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 221 CVEs | before 1.4.6-150100.3.3.7 | 1.4.6-150100.3.3.7 |
lz4SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 221 CVEs | before 1.8.0-3.5.2 | 1.8.0-3.5.2 |
mariadb-connector-cSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 221 CVEs | before 3.1.22-2.35.1 | 3.1.22-2.35.1 |
mariadb104SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 221 CVEs | before 10.4.30-8.5.46 | 10.4.30-8.5.46 |
python-mysqlclientSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 221 CVEs | before 1.3.14-8.9.2 | 1.3.14-8.9.2 |
lz4SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 221 CVEs | before 1.8.0-3.5.2 | 1.8.0-3.5.2 |
mariadb-connector-cSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 221 CVEs | before 3.1.22-2.35.1 | 3.1.22-2.35.1 |
mariadb104SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 221 CVEs | before 10.4.30-8.5.46 | 10.4.30-8.5.46 |
python-mysqlclientSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 221 CVEs | before 1.3.14-8.9.2 | 1.3.14-8.9.2 |
lz4SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 221 CVEs | before 1.8.0-3.5.2 | 1.8.0-3.5.2 |
mariadb-connector-cSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 221 CVEs | before 3.1.22-2.35.1 | 3.1.22-2.35.1 |
mariadb104SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 221 CVEs | before 10.4.30-8.5.46 | 10.4.30-8.5.46 |
python-mysqlclientSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 221 CVEs | before 1.3.14-8.9.2 | 1.3.14-8.9.2 |
mariadbopenSUSE:Tumbleweed From an advisory covering 65 CVEs | before 10.6.4-2.1 | 10.6.4-2.1 |
What each source reports
NVD Score used
MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.
- Record
CVE-2006-4226- CVSS 2.0
- 3.6 Low
AV:N/AC:H/Au:S/C:P/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.
- Record
CVE-2006-4226- Updated
- 2026-11-02
EUVDEUVD-2006-4216No score
MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.
- Record
EUVD-2006-4216- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g59j-2mhw-4h6xNo score
MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive...
MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.
- Record
GHSA-g59j-2mhw-4h6x- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11038-1No score
libmariadbd-devel-10.6.4-2.1 on GA media
These are all security issues fixed in the libmariadbd-devel-10.6.4-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11038-1- Updated
- 2026-11-02
OSVSUSE-RU-2023:3956-1No score
Recommended update for mariadb104
This update for mariadb104 fixes the following issues:
- Implement version 10.4 of MariaDB (jsc#PED-2455):
- It is possible to use more than one authentication plugin for each user account.
- The root user account is being created with the ability to use two authentication plugins.
- All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
- Is being supported for User Password Expiry, which is not active by default.
- Faster privilege checks for MariaDB setups with many user accounts or many database grants.
- Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
- MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
- Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
- Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)
- Record
SUSE-RU-2023:3956-1- Updated
- 2026-11-02
OSVSUSE-RU-2023:4991-1No score
Recommended update for mariadb104
This update for mariadb104 fixes the following issues:
- Implement version 10.4 of MariaDB (jsc#PED-2455):
- It is possible to use more than one authentication plugin for each user account.
- The root user account is being created with the ability to use two authentication plugins.
- All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
- Is being supported for User Password Expiry, which is not active by default.
- Faster privilege checks for MariaDB setups with many user accounts or many database grants.
- Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
- MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
- Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
- Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)
- Record
SUSE-RU-2023:4991-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10729
secunia.com/advisories/21627
securitytracker.com/id?1016710
redhat.com/support/errata/RHSA-2007-0152.html
us-cert.gov/cas/techalerts/TA07-072A.html
Show 194 moreShow less
vupen.com/english/advisories/2006/3306
novell.com/linux/security/advisories/2006_23_sr.html
lists.apple.com/archives/security-announce/2007/Mar/msg00002.html
docs.info.apple.com/article.html?artnum=305214
securityfocus.com/bid/19559
exchange.xforce.ibmcloud.com/vulnerabilities/28448
mandriva.com/security/advisories?name=MDKSA-2006:149
dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
bugs.mysql.com/bug.php?id=17647
lists.mysql.com/commits/5927
debian.org/security/2006/dsa-1169
nvd.nist.gov/vuln/detail/CVE-2006-4226
github.com/advisories/GHSA-g59j-2mhw-4h6x
access.redhat.com/errata/RHSA-2007:0083
bugzilla.redhat.com/show_bug.cgi?id=228999
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0083.json
cve.org/CVERecord?id=CVE-2006-0903
suse.com/support/update/announcement/-2023-3956/suse-ru-20233956-1
bugzilla.suse.com/1001367
This page doesn't list everything
Left out here: 272 references. The JSON record has them.