← back
CVE-2012-5614

CVE-2012-5614

EPSS 13.2%
Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.
Affected products
n/a · n/a
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/23078unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://rhn.redhat.com/errata/RHSA-2013-0772.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=882607http://seclists.org/fulldisclosure/2012/Dec/7http://secunia.com/advisories/53372http://security.gentoo.org/glsa/glsa-201308-06.xmlhttps://mariadb.atlassian.net/browse/MDEV-3910http://www.mandriva.com/security/advisories?name=MDVSA-2013:150http://www.openwall.com/lists/oss-security/2012/12/02/3http://www.openwall.com/lists/oss-security/2012/12/02/4http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlhttp://www.securitytracker.com/id?1027829