CVE-2012-5612

medium · 6.5

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.

6.5

CVSS

20.8%

EPSS (exploit prob.)

97th

EPSS percentile

2012-12-03

Published

AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

CWE-787

Affected products

Vendor	Product	Affected versions
mariadb	mariadb	>= 5.1.0, < 5.1.67
mariadb	mariadb	>= 5.2.0, < 5.2.14
mariadb	mariadb	>= 5.3.0, < 5.3.12
mariadb	mariadb	>= 5.5.0, < 5.5.29
mariadb	mariadb	10.0.0
oracle	mysql	>= 5.5.0, <= 5.5.28
suse	linux_enterprise_desktop	11
suse	linux_enterprise_server	11
suse	linux_enterprise_server	11
suse	linux_enterprise_software_development_kit	11
canonical	ubuntu_linux	10.04
canonical	ubuntu_linux	11.10
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2012-5612