Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted "SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)" statements, which triggers a NULL pointer dereference in the Item_singlerow_subselect::store function.
2011-01-11T20:00:01.603
2025-04-11T00:51:21.963
Deferred
CVSSv2: 4.0 (MEDIUM)
AV:N/AC:L/Au:S/C:N/I:N/A:P
8.0
2.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | mysql | mysql | ≤ 5.1.48 | Yes |
| Application | mysql | mysql | 5.1.23 | Yes |
| Application | mysql | mysql | 5.1.31 | Yes |
| Application | mysql | mysql | 5.1.32 | Yes |
| Application | mysql | mysql | 5.1.34 | Yes |
| Application | mysql | mysql | 5.1.37 | Yes |
| Application | oracle | mysql | 5.1.1 | Yes |
| Application | oracle | mysql | 5.1.2 | Yes |
| Application | oracle | mysql | 5.1.3 | Yes |
| Application | oracle | mysql | 5.1.4 | Yes |
| Application | oracle | mysql | 5.1.10 | Yes |
| Application | oracle | mysql | 5.1.11 | Yes |
| Application | oracle | mysql | 5.1.12 | Yes |
| Application | oracle | mysql | 5.1.13 | Yes |
| Application | oracle | mysql | 5.1.14 | Yes |
| Application | oracle | mysql | 5.1.15 | Yes |
| Application | oracle | mysql | 5.1.16 | Yes |
| Application | oracle | mysql | 5.1.17 | Yes |
| Application | oracle | mysql | 5.1.18 | Yes |
| Application | oracle | mysql | 5.1.19 | Yes |
| Application | oracle | mysql | 5.1.20 | Yes |
| Application | oracle | mysql | 5.1.21 | Yes |
| Application | oracle | mysql | 5.1.22 | Yes |
| Application | oracle | mysql | 5.1.23 | Yes |
| Application | oracle | mysql | 5.1.24 | Yes |
| Application | oracle | mysql | 5.1.25 | Yes |
| Application | oracle | mysql | 5.1.26 | Yes |
| Application | oracle | mysql | 5.1.27 | Yes |
| Application | oracle | mysql | 5.1.28 | Yes |
| Application | oracle | mysql | 5.1.29 | Yes |
| Application | oracle | mysql | 5.1.30 | Yes |
| Application | oracle | mysql | 5.1.31 | Yes |
| Application | oracle | mysql | 5.1.33 | Yes |
| Application | oracle | mysql | 5.1.34 | Yes |
| Application | oracle | mysql | 5.1.35 | Yes |
| Application | oracle | mysql | 5.1.36 | Yes |
| Application | oracle | mysql | 5.1.37 | Yes |
| Application | oracle | mysql | 5.1.38 | Yes |
| Application | oracle | mysql | 5.1.39 | Yes |
| Application | oracle | mysql | 5.1.40 | Yes |
| Application | oracle | mysql | 5.1.40 | Yes |
| Application | oracle | mysql | 5.1.41 | Yes |
| Application | oracle | mysql | 5.1.42 | Yes |
| Application | oracle | mysql | 5.1.43 | Yes |
| Application | oracle | mysql | 5.1.43 | Yes |
| Application | oracle | mysql | 5.1.44 | Yes |
| Application | oracle | mysql | 5.1.45 | Yes |
| Application | oracle | mysql | 5.1.46 | Yes |
| Application | oracle | mysql | 5.1.46 | Yes |
| Application | oracle | mysql | 5.1.47 | Yes |
| Application | mysql | mysql | ≤ 5.0.91 | Yes |
| Application | mysql | mysql | 5.0.0 | Yes |
| Application | mysql | mysql | 5.0.1 | Yes |
| Application | mysql | mysql | 5.0.2 | Yes |
| Application | mysql | mysql | 5.0.10 | Yes |
| Application | mysql | mysql | 5.0.15 | Yes |
| Application | mysql | mysql | 5.0.16 | Yes |
| Application | mysql | mysql | 5.0.17 | Yes |
| Application | mysql | mysql | 5.0.20 | Yes |
| Application | mysql | mysql | 5.0.24 | Yes |
| Application | mysql | mysql | 5.0.30 | Yes |
| Application | mysql | mysql | 5.0.36 | Yes |
| Application | mysql | mysql | 5.0.44 | Yes |
| Application | mysql | mysql | 5.0.54 | Yes |
| Application | mysql | mysql | 5.0.56 | Yes |
| Application | mysql | mysql | 5.0.60 | Yes |
| Application | mysql | mysql | 5.0.66 | Yes |
| Application | mysql | mysql | 5.0.72 | Yes |
| Application | mysql | mysql | 5.0.74 | Yes |
| Application | mysql | mysql | 5.0.82 | Yes |
| Application | mysql | mysql | 5.0.84 | Yes |
| Application | mysql | mysql | 5.0.87 | Yes |
| Application | oracle | mysql | 5.0.28 | Yes |
| Application | oracle | mysql | 5.0.30 | Yes |
| Application | oracle | mysql | 5.0.32 | Yes |
| Application | oracle | mysql | 5.0.34 | Yes |
| Application | oracle | mysql | 5.0.36 | Yes |
| Application | oracle | mysql | 5.0.38 | Yes |
| Application | oracle | mysql | 5.0.40 | Yes |
| Application | oracle | mysql | 5.0.41 | Yes |
| Application | oracle | mysql | 5.0.42 | Yes |
| Application | oracle | mysql | 5.0.44 | Yes |
| Application | oracle | mysql | 5.0.45 | Yes |
| Application | oracle | mysql | 5.0.46 | Yes |
| Application | oracle | mysql | 5.0.48 | Yes |
| Application | oracle | mysql | 5.0.50 | Yes |
| Application | oracle | mysql | 5.0.51 | Yes |
| Application | oracle | mysql | 5.0.51 | Yes |
| Application | oracle | mysql | 5.0.52 | Yes |
| Application | oracle | mysql | 5.0.56 | Yes |
| Application | oracle | mysql | 5.0.58 | Yes |
| Application | oracle | mysql | 5.0.62 | Yes |
| Application | oracle | mysql | 5.0.64 | Yes |
| Application | oracle | mysql | 5.0.66 | Yes |
| Application | oracle | mysql | 5.0.66 | Yes |
| Application | oracle | mysql | 5.0.67 | Yes |
| Application | oracle | mysql | 5.0.68 | Yes |
| Application | oracle | mysql | 5.0.70 | Yes |
| Application | oracle | mysql | 5.0.72 | Yes |
| Application | oracle | mysql | 5.0.74 | Yes |
| Application | oracle | mysql | 5.0.75 | Yes |
| Application | oracle | mysql | 5.0.76 | Yes |
| Application | oracle | mysql | 5.0.77 | Yes |
| Application | oracle | mysql | 5.0.78 | Yes |
| Application | oracle | mysql | 5.0.79 | Yes |
| Application | oracle | mysql | 5.0.80 | Yes |
| Application | oracle | mysql | 5.0.81 | Yes |
| Application | oracle | mysql | 5.0.82 | Yes |
| Application | oracle | mysql | 5.0.83 | Yes |
| Application | oracle | mysql | 5.0.84 | Yes |
| Application | oracle | mysql | 5.0.85 | Yes |
| Application | oracle | mysql | 5.0.86 | Yes |
| Application | oracle | mysql | 5.0.87 | Yes |
| Application | oracle | mysql | 5.0.88 | Yes |
| Application | oracle | mysql | 5.0.89 | Yes |
| Application | oracle | mysql | 5.0.90 | Yes |