CVE-2012-5612

Summary

CVE	CVE-2012-5612
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2012-12-03 12:49:43 UTC
Updated	2026-04-29 01:13:23 UTC
Description	Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.

Risk And Classification

Primary CVSS: v2.0 6.5 from [email protected]

AV:N/AC:L/Au:S/C:P/I:P/A:P

Problem Types: CWE-787 | n/a

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Mariadb	Mariadb	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

References

Reference	Source	Link	Tags
Gentoo Linux Documentation -- MySQL: Multiple vulnerabilities	af854a3a-2127-422b-91ae-364da2661108	security.gentoo.org	Third Party Advisory
Repository / Oval Repository	af854a3a-2127-422b-91ae-364da2661108	oval.cisecurity.org	Third Party Advisory
oss-security - Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List, Third Party Advisory
Oracle Critical Patch Update - January 2013	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Vendor Advisory
[MDEV-3908] crash in multi-table delete and mdl - JIRA	af854a3a-2127-422b-91ae-364da2661108	mariadb.atlassian.net	Broken Link, Exploit, Patch
oss-security - Re: Re: [Full-disclosure] MySQL (Linux) Stack based buffer overrun PoC Zeroday	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List, Third Party Advisory
USN-1703-1: MySQL vulnerabilities \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com	Third Party Advisory
Full Disclosure: MySQL (Linux) Heap Based Overrun PoC Zeroday	af854a3a-2127-422b-91ae-364da2661108	seclists.org	Exploit, Mailing List, Third Party Advisory
[security-announce] SUSE-SU-2013:0262-1: important: Security update for	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org	Mailing List, Third Party Advisory
Support / Security / Advisories / / MDVSA-2013:150 \| Mandriva	af854a3a-2127-422b-91ae-364da2661108	www.mandriva.com	Broken Link
Support / Security / Advisories / / MDVSA-2013:102 \| Mandriva	af854a3a-2127-422b-91ae-364da2661108	www.mandriva.com	Broken Link
About Secunia Research \| Flexera	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Not Applicable
MySQL (Linux) Heap Based Overrun PoC Zeroday	af854a3a-2127-422b-91ae-364da2661108	www.exploit-db.com	Exploit, Third Party Advisory, VDB Entry
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.