6.5

CVE-2012-5612

Exploit
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mariadb ≫ Mariadb Version >= 5.1.0 < 5.1.67
Mariadb ≫ Mariadb Version >= 5.2.0 < 5.2.14
Mariadb ≫ Mariadb Version >= 5.3.0 < 5.3.12
Mariadb ≫ Mariadb Version >= 5.5.0 < 5.5.29
Mariadb ≫ Mariadb Version10.0.0
Oracle ≫ Mysql Version >= 5.5.0 <= 5.5.28
Suse ≫ Linux Enterprise Desktop Version11 Updatesp2
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwPlatform-
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwPlatformvmware
Canonical ≫ Ubuntu Linux Version10.04 SwEdition-
Canonical ≫ Ubuntu Linux Version11.10
Canonical ≫ Ubuntu Linux Version12.04 SwEdition-
Canonical ≫ Ubuntu Linux Version12.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 20.84% 0.972
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
Broken Link
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
Vendor Advisory
http://secunia.com/advisories/53372
Not Applicable
http://security.gentoo.org/glsa/glsa-201308-06.xml
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2012/12/02/3
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2012/12/02/4
Third Party Advisory
Mailing List
http://www.ubuntu.com/usn/USN-1703-1
Third Party Advisory
http://seclists.org/fulldisclosure/2012/Dec/5
Third Party Advisory
Exploit
Mailing List
http://www.exploit-db.com/exploits/23076
Third Party Advisory
Exploit
VDB Entry
https://mariadb.atlassian.net/browse/MDEV-3908
Patch
Exploit
Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16960
Third Party Advisory