Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

MySQL versions up to 5.0.20 leak data via table dump

CVE-2006-1517 · published 20 years ago
Summary

MySQL 4.0.x, 4.1.x and 5.0.x (through 5.0.20) can expose pieces of memory when an attacker sends a specially crafted table‑dump request. The error response may reveal sensitive information stored on the server. Apply the released MySQL patches or upgrade to a newer, supported version as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mysql mysql 4.1.0
4.1.3
4.1.8
4.1.10
4.1.12
4.1.13
4.1.14
4.1.15
5.0.1
5.0.2
5.0.3
5.0.4
5 more version ranges
cpe:2.3:a:mysql:mysql:4.1.0:*:*:*:*:*:*:*
oracle mysql 4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.5a
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
38 more version ranges
cpe:2.3:a:oracle:mysql:4.0.0:*:*:*:*:*:*:*
Original advisory text
sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to obtain sensitive information via a COM_TABLE_DUMP request with an incorrect packet le...
sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to obtain sensitive information via a COM_TABLE_DUMP request with an incorrect packet length, which includes portions of memory in an error message.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
5% chance of attack within 30 days
Timeline
Published5 May 2006
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-1517 · NVD
Track software like this
Free during beta