CVE-2012-5627
NoneCVSS
—
EPSS
11.4%
Published
Oct 1, 2013
CISA due date
—
The record
Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Server 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Server 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Server 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Server 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | mariadb104 | 0 | 10.4.30-150100.3.5.10 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | python-mysqlclient | 0 | 1.4.6-150100.3.3.7 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | lz4 | 0 | 1.8.0-3.5.2 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | mariadb-connector-c | 0 | 3.1.22-2.35.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | mariadb104 | 0 | 10.4.30-8.5.46 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | python-mysqlclient | 0 | 1.3.14-8.9.2 |
| Ubuntu:14.04:LTS | mariadb-5.5 | 0 | 5.5.36-1 |
| Ubuntu:14.04:LTS | mysql-5.5 | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | mysql-5.5 | 0 | No fix |
| openSUSE:Tumbleweed | mariadb | 0 | 10.0.22-3.8 |
Related vulnerabilities
- CVE-2017-3302 Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and… Also affects mariadb104
- CVE-2016-5584 Unspecified vulnerability in Oracle MySQL 5.5.52 and earlier, 5.6.33 and earlier, and… Also affects mariadb104
- CVE-2016-6662 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… Also affects mariadb104
- CVE-2016-3521 Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and… Also affects mariadb104
- CVE-2015-4870 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and… Also affects mariadb104
- CVE-2012-5615 Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13… Also affects mariadb104
- CVE-2012-5611 Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other… Also affects mariadb104
- CVE-2012-5612 Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and… Also affects mariadb104