CVE-2006-4227

MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

• CWE-20

• http://bugs.mysql.com/bug.php?id=18630Exploit
• http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
• http://lists.mysql.com/commits/7918
• http://secunia.com/advisories/21506Vendor Advisory
• http://secunia.com/advisories/21770Vendor Advisory
• http://secunia.com/advisories/22080Vendor Advisory
• http://secunia.com/advisories/30351Vendor Advisory
• http://securitytracker.com/id?1016709
• http://www.novell.com/linux/security/advisories/2006_23_sr.html
• http://www.redhat.com/support/errata/RHSA-2007-0083.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2008-0364.htmlVendor Advisory
• http://www.securityfocus.com/bid/19559Exploit
• http://www.ubuntu.com/usn/usn-338-1
• http://www.vupen.com/english/advisories/2006/3306Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28442
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10105
• http://bugs.mysql.com/bug.php?id=18630Exploit
• http://dev.mysql.com/doc/refman/5.0/en/news-5-0-25.html
• http://lists.mysql.com/commits/7918
• http://secunia.com/advisories/21506Vendor Advisory
• http://secunia.com/advisories/21770Vendor Advisory
• http://secunia.com/advisories/22080Vendor Advisory
• http://secunia.com/advisories/30351Vendor Advisory
• http://securitytracker.com/id?1016709
• http://www.novell.com/linux/security/advisories/2006_23_sr.html
• http://www.redhat.com/support/errata/RHSA-2007-0083.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2008-0364.htmlVendor Advisory
• http://www.securityfocus.com/bid/19559Exploit
• http://www.ubuntu.com/usn/usn-338-1
• http://www.vupen.com/english/advisories/2006/3306Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28442
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10105

Published

Aug 18, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4221Stack-based buffer overflow in the IBM Access Support eGathe…
• CVE-2006-4222Multiple unspecified vulnerabilities in IBM WebSphere Applic…
• CVE-2006-4223IBM WebSphere Application Server (WAS) before 6.0.2.13 allow…
• CVE-2006-4224Cross-site scripting (XSS) vulnerability in calendar.php in …
• CVE-2006-4225Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2006-4226MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.1…
• CVE-2006-4228Symantec Veritas NetBackup PureDisk Remote Office Edition 6.…
• CVE-2006-4229PHP remote file inclusion vulnerability in archive.php in th…
• CVE-2006-4230Multiple PHP remote file inclusion vulnerabilities in index.…
• CVE-2006-4231IrfanView 3.98 (with plugins) allows remote attackers to cau…
• CVE-2006-4232Race condition in the grid-proxy-init tool in Globus Toolkit…
• CVE-2006-4233Globus Toolkit 3.2.x, 4.0.x, and 4.1.0 before 20060815 allow…