CVE-2012-5614
Fixed in a distro release EPSS 13%
Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.
Products: oracle mysql, mariadb, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 6 | mysql | 0:5.1.69-1.el6_4 |
| Red Hat Enterprise Linux 6 | mysql-bench | 0:5.1.69-1.el6_4 |
| Red Hat Enterprise Linux 6 | mysql-debuginfo | 0:5.1.69-1.el6_4 |
| Red Hat Enterprise Linux 6 | mysql-devel | 0:5.1.69-1.el6_4 |
| Red Hat Enterprise Linux 6 | mysql-embedded | 0:5.1.69-1.el6_4 |
| Red Hat Enterprise Linux 6 | mysql-embedded-devel | 0:5.1.69-1.el6_4 |
| Red Hat Enterprise Linux 6 | mysql-libs | 0:5.1.69-1.el6_4 |
| Red Hat Enterprise Linux 6 | mysql-server | 0:5.1.69-1.el6_4 |
| Red Hat Enterprise Linux 6 | mysql-test | 0:5.1.69-1.el6_4 |