CVE-2009-4019
NoneCVSS
—
EPSS
16.3%
Published
Nov 30, 2009
CISA due date
—
The record
mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:4.0 | mysql-dfsg-5.0 | 0 | 5.0.32-7etch12 |
| Debian:5.0 | mysql-dfsg-5.0 | 0 | 5.0.51a-24+lenny3 |
| Red Hat:enterprise_linux:5::client | mysql | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client | mysql-bench | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client | mysql-debuginfo | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client | mysql-devel | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client | mysql-server | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client | mysql-test | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | mysql | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-bench | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-debuginfo | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-devel | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-server | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | mysql-test | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::server | mysql | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::server | mysql-bench | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::server | mysql-debuginfo | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::server | mysql-devel | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::server | mysql-server | 0 | 0:5.0.77-4.el5_4.2 |
| Red Hat:enterprise_linux:5::server | mysql-test | 0 | 0:5.0.77-4.el5_4.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Server 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Server 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Server 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Server 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| openSUSE:Tumbleweed | mariadb | 0 | 10.0.22-3.8 |
Related vulnerabilities
- CVE-2009-4484 Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp… Also affects mysql-dfsg-5.0
- CVE-2009-2446 Multiple format string vulnerabilities in the dispatch_command function in… Also affects mysql-dfsg-5.0
- CVE-2008-0226 Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other… Also affects mysql-dfsg-5.0
- CVE-2007-5969 MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server… Also affects mysql-dfsg-5.0
- CVE-2007-5925 The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in… Also affects mysql-dfsg-5.0
- CVE-2007-3780 MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service… Also affects mysql-dfsg-5.0
- CVE-2007-2583 The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before… Also affects mysql-dfsg-5.0
- CVE-2010-3681 Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to… Also affects mysql-dfsg-5.0