Vulnerability Description
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mariadb | Mariadb | >= 5.1.0, < 5.1.67 |
| Oracle | Mysql | >= 5.5.0, <= 5.5.28 |
| Suse | Linux Enterprise Desktop | 11 |
| Suse | Linux Enterprise Server | 11 |
| Suse | Linux Enterprise Software Development Kit | 11 |
| Canonical | Ubuntu Linux | 10.04 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.htmlMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2012/Dec/5ExploitMailing ListThird Party Advisory
- http://secunia.com/advisories/53372Not Applicable
- http://security.gentoo.org/glsa/glsa-201308-06.xmlThird Party Advisory
- http://www.exploit-db.com/exploits/23076ExploitThird Party AdvisoryVDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:102Broken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150Broken Link
- http://www.openwall.com/lists/oss-security/2012/12/02/3Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2012/12/02/4Mailing ListThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.htmlVendor Advisory
- http://www.ubuntu.com/usn/USN-1703-1Third Party Advisory
- https://mariadb.atlassian.net/browse/MDEV-3908Broken LinkExploitPatch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.htmlMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2012/Dec/5ExploitMailing ListThird Party Advisory
FAQ
What is CVE-2012-5612?
CVE-2012-5612 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (me...
How severe is CVE-2012-5612?
CVE-2012-5612 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-5612?
Check the references section above for vendor advisories and patch information. Affected products include: Mariadb Mariadb, Oracle Mysql, Suse Linux Enterprise Desktop, Suse Linux Enterprise Server, Suse Linux Enterprise Software Development Kit.