Vulnerability in Mariadb
CVE-2012-5614
Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.
EPSS: 0.132 (96.0th percentile) — read the EPSS interpretation.
Affected products
- Mariadb
- Oracle Mysql
- Redhat Enterprise_linux_desktop — versions 6.0
- Redhat Enterprise_linux_eus — versions 6.4
- Redhat Enterprise_linux_server — versions 6.0
- Redhat Enterprise_linux_server_aus — versions 6.4
- Redhat Enterprise_linux_workstation — versions 6.0
- N/a — versions n/a
Public proof-of-concept exploits
References
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- secalert@redhat.com (x_refsource_SECUNIA, Not Applicable, third-party-advisory)
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- secalert@redhat.com (x_refsource_MISC, Issue Tracking)
- secalert@redhat.com (Patch, x_refsource_MISC, Broken Link)
Frequently asked questions
- What is CVE-2012-5614?
- CVE-2012-5614 is a vulnerability in Mariadb. Published 2012-12-03.
- Is CVE-2012-5614 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.