CVE-2012-5611
NoneCVSS
—
EPSS
24.0%
Published
Dec 3, 2012
CISA due date
—
The record
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:6.0 | mysql-5.1 | 0 | 5.1.66-0+squeeze1 |
| Red Hat:enterprise_linux:5::server | mysql | 0 | 0:5.0.95-5.el5_9 |
| Red Hat:enterprise_linux:5::server | mysql-bench | 0 | 0:5.0.95-5.el5_9 |
| Red Hat:enterprise_linux:5::server | mysql-debuginfo | 0 | 0:5.0.95-5.el5_9 |
| Red Hat:enterprise_linux:5::server | mysql-devel | 0 | 0:5.0.95-5.el5_9 |
| Red Hat:enterprise_linux:5::server | mysql-server | 0 | 0:5.0.95-5.el5_9 |
| Red Hat:enterprise_linux:5::server | mysql-test | 0 | 0:5.0.95-5.el5_9 |
| Red Hat:enterprise_linux:6::client | mysql | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::client | mysql-bench | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::client | mysql-debuginfo | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::client | mysql-devel | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::client | mysql-embedded | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::client | mysql-embedded-devel | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::client | mysql-libs | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::client | mysql-server | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::client | mysql-test | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::computenode | mysql | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::computenode | mysql-bench | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::computenode | mysql-debuginfo | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::computenode | mysql-devel | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::computenode | mysql-embedded | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::computenode | mysql-embedded-devel | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::computenode | mysql-libs | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::computenode | mysql-server | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::computenode | mysql-test | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::server | mysql | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::server | mysql-bench | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::server | mysql-debuginfo | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::server | mysql-devel | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::server | mysql-embedded | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::server | mysql-embedded-devel | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::server | mysql-libs | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::server | mysql-server | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::server | mysql-test | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::workstation | mysql | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::workstation | mysql-bench | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::workstation | mysql-debuginfo | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::workstation | mysql-devel | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::workstation | mysql-embedded | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::workstation | mysql-embedded-devel | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::workstation | mysql-libs | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::workstation | mysql-server | 0 | 0:5.1.66-2.el6_3 |
| Red Hat:enterprise_linux:6::workstation | mysql-test | 0 | 0:5.1.66-2.el6_3 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Server 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Server 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Server 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Server 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| openSUSE:Tumbleweed | mariadb | 0 | 10.0.22-3.8 |
Related vulnerabilities
- CVE-2014-0001 Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows… Also affects mysql-5.1
- CVE-2013-1861 MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before… Also affects mysql-5.1
- CVE-2012-2122 sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before… Also affects mysql-5.1
- CVE-2010-3681 Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to… Also affects mysql
- CVE-2010-3680 Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of… Also affects mysql
- CVE-2010-3682 Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to… Also affects mysql
- CVE-2010-1850 Buffer overflow in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote… Also affects mysql
- CVE-2009-4019 mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle… Also affects mysql