Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.0
CVE-2012-5614: MySQL and MariaDB can crash when crafted SELECT runs
CVE-2012-5614 · published 13 years ago
Summary
If a user who can log in to the database sends a specially crafted SELECT query that includes an UpdateXML call with many nested XML elements, the database server can stop working and restart. This affects MySQL versions up to 5.1.67 and 5.5.29, and MariaDB up to 5.5.28a, as well as any systems using those packages. Apply the latest security updates from the vendor or upgrade to newer released versions to prevent the crash.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| oracle | mysql |
>= 5.1.0, <= 5.1.67 >= 5.5.0, <= 5.5.29 cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* |
| mariadb | mariadb |
>= 5.5.0, < 5.5.30 >= 10.0.0, < 10.0.2 cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop |
6.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus |
6.4 cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server |
6.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus |
6.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation |
6.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* |
Original advisory text
Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT c...
Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.
References
- http://rhn.redhat.com/errata/RHSA-2013-0772.html Third Party Advisory
- http://seclists.org/fulldisclosure/2012/Dec/7 Exploit Mailing List Third Party Advisory
- http://secunia.com/advisories/53372 Not Applicable
- http://security.gentoo.org/glsa/glsa-201308-06.xml Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 Broken Link
- http://www.openwall.com/lists/oss-security/2012/12/02/3 Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/12/02/4 Mailing List Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html Vendor Advisory
- http://www.securitytracker.com/id?1027829 Broken Link Third Party Advisory VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=882607 Issue Tracking
- https://mariadb.atlassian.net/browse/MDEV-3910 Broken Link Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
4.0
Medium
Timeline
Published3 Dec 2012
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2012-5614 · NVD
Track software like this
Free during beta