CVE-2012-5612

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-5612
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2012/Dec/5 Exploit Mailing List Third Party Advisory
http://secunia.com/advisories/53372 Not Applicable
http://security.gentoo.org/glsa/glsa-201308-06.xml Third Party Advisory
http://www.exploit-db.com/exploits/23076 Exploit Third Party Advisory VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 Broken Link
http://www.openwall.com/lists/oss-security/2012/12/02/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/12/02/4 Mailing List Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Vendor Advisory
http://www.ubuntu.com/usn/USN-1703-1 Third Party Advisory
https://mariadb.atlassian.net/browse/MDEV-3908 Broken Link Exploit Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16960 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:10.0.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
History

20 Jul 2022, 16:24

Type Values Removed Values Added
References (FULLDISC) http://seclists.org/fulldisclosure/2012/Dec/5 - Exploit (FULLDISC) http://seclists.org/fulldisclosure/2012/Dec/5 - Exploit, Mailing List, Third Party Advisory
References (SECUNIA) http://secunia.com/advisories/53372 - (SECUNIA) http://secunia.com/advisories/53372 - Not Applicable
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 - Broken Link
References (CONFIRM) http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html - (CONFIRM) http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html - Vendor Advisory
References (CONFIRM) https://mariadb.atlassian.net/browse/MDEV-3908 - Exploit, Patch (CONFIRM) https://mariadb.atlassian.net/browse/MDEV-3908 - Broken Link, Exploit, Patch
References (UBUNTU) http://www.ubuntu.com/usn/USN-1703-1 - (UBUNTU) http://www.ubuntu.com/usn/USN-1703-1 - Third Party Advisory
References (EXPLOIT-DB) http://www.exploit-db.com/exploits/23076 - Exploit (EXPLOIT-DB) http://www.exploit-db.com/exploits/23076 - Exploit, Third Party Advisory, VDB Entry
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 - Broken Link
References (MLIST) http://www.openwall.com/lists/oss-security/2012/12/02/3 - (MLIST) http://www.openwall.com/lists/oss-security/2012/12/02/3 - Mailing List, Third Party Advisory
References (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16960 - (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16960 - Third Party Advisory
References (GENTOO) http://security.gentoo.org/glsa/glsa-201308-06.xml - (GENTOO) http://security.gentoo.org/glsa/glsa-201308-06.xml - Third Party Advisory
References (MLIST) http://www.openwall.com/lists/oss-security/2012/12/02/4 - (MLIST) http://www.openwall.com/lists/oss-security/2012/12/02/4 - Mailing List, Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html - Mailing List, Third Party Advisory
CPE cpe:2.3:o:linux:linux:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:5.5.28a:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:5.5.19:*:*:*:*:*:*:*		 cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
CWE CWE-119 CWE-787
Information

Published : 2012-12-03 12:49

Updated : 2024-02-04 18:16

NVD link : CVE-2012-5612

Mitre link : CVE-2012-5612

CVE.ORG link : CVE-2012-5612

JSON object : View

Products Affected

oracle

  • mysql

canonical

  • ubuntu_linux

suse

  • linux_enterprise_server
  • linux_enterprise_software_development_kit
  • linux_enterprise_desktop

mariadb

  • mariadb
CWE
CWE-787

Out-of-bounds Write