6.5

CVE-2012-5612

Exploit

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.

Data is provided by the National Vulnerability Database (NVD)
Mariadb ≫ Mariadb Version >= 5.1.0 < 5.1.67
Mariadb ≫ Mariadb Version >= 5.2.0 < 5.2.14
Mariadb ≫ Mariadb Version >= 5.3.0 < 5.3.12
Mariadb ≫ Mariadb Version >= 5.5.0 < 5.5.29
Mariadb ≫ Mariadb Version10.0.0
Oracle ≫ Mysql Version >= 5.5.0 <= 5.5.28
Suse ≫ Linux Enterprise Desktop Version11 Updatesp2
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwPlatform-
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwPlatformvmware
Canonical ≫ Ubuntu Linux Version10.04 SwEdition-
Canonical ≫ Ubuntu Linux Version11.10
Canonical ≫ Ubuntu Linux Version12.04 SwEdition-
Canonical ≫ Ubuntu Linux Version12.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 61.21% 0.983
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://seclists.org/fulldisclosure/2012/Dec/5
Third Party Advisory
Exploit
Mailing List
http://www.exploit-db.com/exploits/23076
Third Party Advisory
Exploit
VDB Entry