Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2012-5611

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.

Published

2012-12-03T12:49:43.363

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-119

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mariadb	mariadb	5.1.41	Yes
Application	mariadb	mariadb	5.1.42	Yes
Application	mariadb	mariadb	5.1.44	Yes
Application	mariadb	mariadb	5.1.47	Yes
Application	mariadb	mariadb	5.1.49	Yes
Application	mariadb	mariadb	5.1.50	Yes
Application	mariadb	mariadb	5.1.51	Yes
Application	mariadb	mariadb	5.1.53	Yes
Application	mariadb	mariadb	5.1.55	Yes
Application	mariadb	mariadb	5.1.60	Yes
Application	mariadb	mariadb	5.1.61	Yes
Application	mariadb	mariadb	5.1.62	Yes
Application	mariadb	mariadb	5.2.0	Yes
Application	mariadb	mariadb	5.2.1	Yes
Application	mariadb	mariadb	5.2.2	Yes
Application	mariadb	mariadb	5.2.3	Yes
Application	mariadb	mariadb	5.2.4	Yes
Application	mariadb	mariadb	5.2.5	Yes
Application	mariadb	mariadb	5.2.6	Yes
Application	mariadb	mariadb	5.2.7	Yes
Application	mariadb	mariadb	5.2.8	Yes
Application	mariadb	mariadb	5.2.9	Yes
Application	mariadb	mariadb	5.2.10	Yes
Application	mariadb	mariadb	5.2.11	Yes
Application	mariadb	mariadb	5.2.12	Yes
Application	mariadb	mariadb	5.3.0	Yes
Application	mariadb	mariadb	5.3.1	Yes
Application	mariadb	mariadb	5.3.2	Yes
Application	mariadb	mariadb	5.3.3	Yes
Application	mariadb	mariadb	5.3.4	Yes
Application	mariadb	mariadb	5.3.5	Yes
Application	mariadb	mariadb	5.3.6	Yes
Application	mariadb	mariadb	5.3.7	Yes
Application	mariadb	mariadb	5.3.8	Yes
Application	mariadb	mariadb	5.3.9	Yes
Application	mariadb	mariadb	5.3.10	Yes
Application	mariadb	mariadb	5.5.20	Yes
Application	mariadb	mariadb	5.5.21	Yes
Application	mariadb	mariadb	5.5.22	Yes
Application	mariadb	mariadb	5.5.23	Yes
Application	mariadb	mariadb	5.5.24	Yes
Application	mariadb	mariadb	5.5.25	Yes
Application	mariadb	mariadb	5.5.27	Yes
Application	mariadb	mariadb	5.5.28	Yes
Application	oracle	mysql	5.1.53	Yes
Application	oracle	mysql	5.5.19	Yes
Operating System	linux	linux_kernel	-	No

References

http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00001.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00013.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00020.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-updates/2013-09/msg00010.html Mailing List, Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2012-1551.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0180.html Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2012/Dec/4 Mailing List, Third Party Advisory ([email protected])
http://secunia.com/advisories/51443 Broken Link ([email protected])
http://secunia.com/advisories/53372 Broken Link ([email protected])
http://security.gentoo.org/glsa/glsa-201308-06.xml Third Party Advisory ([email protected])
http://www.debian.org/security/2012/dsa-2581 Third Party Advisory ([email protected])
http://www.exploit-db.com/exploits/23075 Third Party Advisory, VDB Entry ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 Third Party Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2012/12/02/3 Mailing List, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2012/12/02/4 Mailing List, Third Party Advisory ([email protected])
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Third Party Advisory ([email protected])
http://www.ubuntu.com/usn/USN-1658-1 Third Party Advisory ([email protected])
http://www.ubuntu.com/usn/USN-1703-1 Third Party Advisory ([email protected])
https://kb.askmonty.org/en/mariadb-5166-release-notes/ Third Party Advisory ([email protected])
https://kb.askmonty.org/en/mariadb-5213-release-notes/ Third Party Advisory ([email protected])
https://kb.askmonty.org/en/mariadb-5311-release-notes/ Third Party Advisory ([email protected])
https://kb.askmonty.org/en/mariadb-5528a-release-notes/ Third Party Advisory ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16395 Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00001.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00013.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00020.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-updates/2013-09/msg00010.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2012-1551.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0180.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2012/Dec/4 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/51443 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/53372 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-201308-06.xml Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2012/dsa-2581 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.exploit-db.com/exploits/23075 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2012/12/02/3 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2012/12/02/4 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-1658-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-1703-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://kb.askmonty.org/en/mariadb-5166-release-notes/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://kb.askmonty.org/en/mariadb-5213-release-notes/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://kb.askmonty.org/en/mariadb-5311-release-notes/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://kb.askmonty.org/en/mariadb-5528a-release-notes/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16395 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)