CVE-2012-5614

Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P

EPSS

13.18% chance of exploitation in the next 30 days, 96th percentile

Published

2012-12-03

Updated

2024-08-06

Proof-of-concept exploits (3)

• http://seclists.org/fulldisclosure/2012/Dec/7
• http://www.openwall.com/lists/oss-security/2012/12/02/3
• http://www.openwall.com/lists/oss-security/2012/12/02/4

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/23078

References

• CVE Record
• NVD entry

Related

• CVE-2012-5613
• CVE-2012-5615
• CVE-2012-5612
• CVE-2012-5627
• CVE-2012-5611
• CVE-2012-5656