Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name MDVSA-2013:007 First vendor Publication 2013-02-05
Vendor Mandriva Last vendor Modification 2013-02-05
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:C)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

This is a maintenance and bugfix release that upgrades mysql to the latest version which resolves various upstream bugs and a total of 18 security related bugs (CVE-2012-0572, CVE-2012-0574, CVE-2012-0578, CVE-2012-1702, CVE-2012-1705, CVE-2012-5060, CVE-2012-5096, CVE-2012-5611, CVE-2012-5612, CVE-2013-0367, CVE-2013-0368, CVE-2013-0371, CVE-2013-0375, CVE-2013-0383, CVE-2013-0384, CVE-2013-0385, CVE-2013-0386, CVE-2013-0389).

Please consult the Oracle security matrix for further information regarding these security issues and the MySQL release notes.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2013:007

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-787 Out-of-bounds Write (CWE/SANS Top 25)
50 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:16267
 
Oval ID: oval:org.mitre.oval:def:16267
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Replication). Supported versions that are affected are 5.1.66 and earlier and 5.5.28 and earlier. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized write access to any arbitrary Operating System location as well as read access to any arbitrary Operating System location
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows local users to affect confidentiality and integrity via unknown vectors related to Server Replication.
Family: windows Class: vulnerability
Reference(s): CVE-2013-0385
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16395
 
Oval ID: oval:org.mitre.oval:def:16395
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Privileges). Supported versions that are affected are 5.1.66 and earlier and 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution
Description: Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.
Family: windows Class: vulnerability
Reference(s): CVE-2012-5611
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16451
 
Oval ID: oval:org.mitre.oval:def:16451
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: MyISAM). Supported versions that are affected are 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability, related to MyISAM.
Family: windows Class: vulnerability
Reference(s): CVE-2013-0371
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16632
 
Oval ID: oval:org.mitre.oval:def:16632
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Information Schema). Supported versions that are affected are 5.1.66 and earlier and 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS)
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Information Schema.
Family: windows Class: vulnerability
Reference(s): CVE-2013-0384
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16758
 
Oval ID: oval:org.mitre.oval:def:16758
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Locking). Supported versions that are affected are 5.1.66 and earlier and 5.5.28 and earlier. Difficult to exploit vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote attackers to affect availability via unknown vectors related to Server Locking.
Family: windows Class: vulnerability
Reference(s): CVE-2013-0383
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16792
 
Oval ID: oval:org.mitre.oval:def:16792
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.1.66 and earlier and 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
Family: windows Class: vulnerability
Reference(s): CVE-2012-0572
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16825
 
Oval ID: oval:org.mitre.oval:def:16825
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Optimizer). Supported versions that are affected are 5.1.66 and earlier and 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS)
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
Family: windows Class: vulnerability
Reference(s): CVE-2013-0389
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16835
 
Oval ID: oval:org.mitre.oval:def:16835
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Stored Procedure). Supported versions that are affected are 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System hang or frequently repeatable crash (complete DOS)
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Stored Procedure.
Family: windows Class: vulnerability
Reference(s): CVE-2013-0386
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16877
 
Oval ID: oval:org.mitre.oval:def:16877
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Privileges). Supported versions that are affected are 5.5.28 and earlier. Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users with Server Privileges to affect availability via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-5096
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16947
 
Oval ID: oval:org.mitre.oval:def:16947
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Optimizer). Supported versions that are affected are 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
Family: windows Class: vulnerability
Reference(s): CVE-2012-0578
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16960
 
Oval ID: oval:org.mitre.oval:def:16960
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Parser). Supported versions that are affected are 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution
Description: Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.
Family: windows Class: vulnerability
Reference(s): CVE-2012-5612
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17077
 
Oval ID: oval:org.mitre.oval:def:17077
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Partition). Supported versions that are affected are 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Partition.
Family: windows Class: vulnerability
Reference(s): CVE-2013-0367
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17175
 
Oval ID: oval:org.mitre.oval:def:17175
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Replication). Supported versions that are affected are 5.1.66 and earlier and 5.1.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized update, insert or delete access to all MySQL Server accessible data as well as read access to all MySQL Server accessible data
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.1.28 and earlier, allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Server Replication.
Family: windows Class: vulnerability
Reference(s): CVE-2013-0375
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17186
 
Oval ID: oval:org.mitre.oval:def:17186
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server). Supported versions that are affected are 5.1.66 and earlier and 5.5.28 and earlier. Easily exploitable vulnerability allows successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote attackers to affect availability via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1702
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17255
 
Oval ID: oval:org.mitre.oval:def:17255
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
Family: windows Class: vulnerability
Reference(s): CVE-2013-0368
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17266
 
Oval ID: oval:org.mitre.oval:def:17266
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server). Supported versions that are affected are 5.1.66 and earlier and 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-0574
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17268
 
Oval ID: oval:org.mitre.oval:def:17268
Title: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server Optimizer). Supported versions that are affected are 5.1.66 and earlier and 5.5.28 and earlier. Easily exploitable vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1705
Version: 6
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Product(s): MySQL Server 5.1
MySQL Server 5.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17289
 
Oval ID: oval:org.mitre.oval:def:17289
Title: USN-1658-1 -- mysql-5.1, mysql-5.5, mysql-dfsg-5.1 vulnerability
Description: MySQL could be made to run programs if it received specially crafted network traffic from an authenticated user.
Family: unix Class: patch
Reference(s): USN-1658-1
CVE-2012-5611
Version: 7
Platform(s): Ubuntu 12.10
Ubuntu 12.04
Ubuntu 11.10
Ubuntu 10.04
Product(s): mysql-5.5
mysql-5.1
mysql-dfsg-5.1
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18161
 
Oval ID: oval:org.mitre.oval:def:18161
Title: USN-1703-1 -- mysql-5.1, mysql-5.5, mysql-dfsg-5.1 vulnerabilities
Description: Several security issues were fixed in MySQL.
Family: unix Class: patch
Reference(s): USN-1703-1
CVE-2012-0572
CVE-2012-0574
CVE-2012-0578
CVE-2012-1702
CVE-2012-1705
CVE-2012-5060
CVE-2012-5096
CVE-2012-5611
CVE-2012-5612
CVE-2013-0367
CVE-2013-0368
CVE-2013-0371
CVE-2013-0375
CVE-2013-0383
CVE-2013-0384
CVE-2013-0385
CVE-2013-0386
CVE-2013-0389
Version: 7
Platform(s): Ubuntu 12.10
Ubuntu 12.04
Ubuntu 11.10
Ubuntu 10.04
Product(s): mysql-5.5
mysql-5.1
mysql-dfsg-5.1
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18423
 
Oval ID: oval:org.mitre.oval:def:18423
Title: DSA-2581-1 mysql-5.1 - several
Description: Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.1.66, which includes additional changes, such as performance improvements and corrections for data loss defects. These changes are described in the <a href="http://dev.mysql.com/doc/refman/5.1/en/news-5-1-66.html">MySQL release notes</a>.
Family: unix Class: patch
Reference(s): DSA-2581-1
CVE-2012-3150
CVE-2012-3158
CVE-2012-3160
CVE-2012-3163
CVE-2012-3166
CVE-2012-3167
CVE-2012-3173
CVE-2012-3177
CVE-2012-3180
CVE-2012-3197
CVE-2012-5611
Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): mysql-5.1
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21000
 
Oval ID: oval:org.mitre.oval:def:21000
Title: RHSA-2013:0219: mysql security update (Moderate)
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
Family: unix Class: patch
Reference(s): RHSA-2013:0219-02
CESA-2013:0219
CVE-2012-0572
CVE-2012-0574
CVE-2012-1702
CVE-2012-1705
CVE-2013-0375
CVE-2013-0383
CVE-2013-0384
CVE-2013-0385
CVE-2013-0389
Version: 129
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): mysql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21022
 
Oval ID: oval:org.mitre.oval:def:21022
Title: RHSA-2013:0180: mysql security update (Important)
Description: Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.
Family: unix Class: patch
Reference(s): RHSA-2013:0180-00
CESA-2013:0180
CVE-2012-2749
CVE-2012-5611
Version: 31
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): mysql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21528
 
Oval ID: oval:org.mitre.oval:def:21528
Title: RHSA-2012:1551: mysql security update (Important)
Description: Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.
Family: unix Class: patch
Reference(s): RHSA-2012:1551-01
CESA-2012:1551
CVE-2012-5611
Version: 4
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): mysql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23326
 
Oval ID: oval:org.mitre.oval:def:23326
Title: ELSA-2013:0180: mysql security update (Important)
Description: Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.
Family: unix Class: patch
Reference(s): ELSA-2013:0180-00
CVE-2012-2749
CVE-2012-5611
Version: 13
Platform(s): Oracle Linux 5
Product(s): mysql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23738
 
Oval ID: oval:org.mitre.oval:def:23738
Title: ELSA-2013:0219: mysql security update (Moderate)
Description: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
Family: unix Class: patch
Reference(s): ELSA-2013:0219-02
CVE-2012-0572
CVE-2012-0574
CVE-2012-1702
CVE-2012-1705
CVE-2013-0375
CVE-2013-0383
CVE-2013-0384
CVE-2013-0385
CVE-2013-0389
Version: 41
Platform(s): Oracle Linux 6
Product(s): mysql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23921
 
Oval ID: oval:org.mitre.oval:def:23921
Title: ELSA-2012:1551: mysql security update (Important)
Description: Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.
Family: unix Class: patch
Reference(s): ELSA-2012:1551-01
CVE-2012-5611
Version: 6
Platform(s): Oracle Linux 6
Product(s): mysql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25951
 
Oval ID: oval:org.mitre.oval:def:25951
Title: SUSE-SU-2013:0262-1 -- Security update for MySQL
Description: A stack-based buffer overflow in MySQL has been fixed that could have caused a Denial of Service or potentially allowed the execution of arbitrary code (CVE-2012-5611).
Family: unix Class: patch
Reference(s): SUSE-SU-2013:0262-1
CVE-2012-5611
CVE-2012-5615
CVE-2012-5613
CVE-2012-5612
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
Product(s): MySQL
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26706
 
Oval ID: oval:org.mitre.oval:def:26706
Title: DEPRECATED: ELSA-2012-1551 -- mysql security update (important)
Description: [5.1.66-2] - Add backported patch for CVE-2012-5611 Resolves: CVE-2012-5611
Family: unix Class: patch
Reference(s): ELSA-2012-1551
CVE-2012-5611
Version: 4
Platform(s): Oracle Linux 6
Product(s): mysql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27382
 
Oval ID: oval:org.mitre.oval:def:27382
Title: DEPRECATED: ELSA-2013-0219 -- mysql security update (moderate)
Description: [5.1.67-1] - Update to 5.1.67, for assorted upstream bugfixes including CVEs announced in January 2013 Resolves: #901380
Family: unix Class: patch
Reference(s): ELSA-2013-0219
CVE-2012-0572
CVE-2012-0574
CVE-2012-1702
CVE-2012-1705
CVE-2013-0375
CVE-2013-0383
CVE-2013-0384
CVE-2013-0385
CVE-2013-0389
Version: 4
Platform(s): Oracle Linux 6
Product(s): mysql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27670
 
Oval ID: oval:org.mitre.oval:def:27670
Title: DEPRECATED: ELSA-2013-0180 -- mysql security update (important)
Description: [5.0.95-5] - Rebuild to fix wrong package tag Related: #892679 [5.0.95-4] - Add patches for CVE-2012-2122, CVE-2012-2749, CVE-2012-5611 Resolves: #892679
Family: unix Class: patch
Reference(s): ELSA-2013-0180
CVE-2012-2749
CVE-2012-5611
Version: 4
Platform(s): Oracle Linux 5
Product(s): mysql
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 56
Application 387
Os 5
Os 1
Os 2
Os 1
Os 1
Os 1
Os 1
Os 2
Os 1

OpenVAS Exploits

Date Description
2013-09-18 Name : Debian Security Advisory DSA 2581-1 (mysql-5.1 - several vulnerabilities)
File : nvt/deb_2581_1.nasl
2012-12-26 Name : Fedora Update for mysql FEDORA-2012-19823
File : nvt/gb_fedora_2012_19823_mysql_fc16.nasl
2012-12-18 Name : Fedora Update for mysql FEDORA-2012-19833
File : nvt/gb_fedora_2012_19833_mysql_fc17.nasl
2012-12-11 Name : Ubuntu Update for mysql-5.5 USN-1658-1
File : nvt/gb_ubuntu_USN_1658_1.nasl
2012-12-10 Name : CentOS Update for mysql CESA-2012:1551 centos6
File : nvt/gb_CESA-2012_1551_mysql_centos6.nasl
2012-12-10 Name : RedHat Update for mysql RHSA-2012:1551-01
File : nvt/gb_RHSA-2012_1551-01_mysql.nasl
2012-12-10 Name : Mandriva Update for mysql MDVSA-2012:178 (mysql)
File : nvt/gb_mandriva_MDVSA_2012_178.nasl

Snort® IPS/IDS

Date Description
2014-01-10 Oracle MySQL MDL free corrupted pointer heap overflow attempt
RuleID : 24910 - Revision : 4 - Type : SERVER-MYSQL
2014-01-10 Oracle MySQL grant file long database name stack overflow attempt
RuleID : 24897 - Revision : 5 - Type : SERVER-MYSQL

Nessus® Vulnerability Scanner

Date Description
2014-12-22 Name : The remote device is affected by multiple vulnerabilities.
File : juniper_space_jsa10601.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-6.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-5.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-4.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-145.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-144.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-152.nasl - Type : ACT_GATHER_INFO
2013-08-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201308-06.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-0219.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-0180.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1551.nasl - Type : ACT_GATHER_INFO
2013-04-20 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-102.nasl - Type : ACT_GATHER_INFO
2013-03-29 Name : The remote database server is affected by multiple vulnerabilities.
File : mariadb_5_5_28.nasl - Type : ACT_GATHER_INFO
2013-02-28 Name : The remote database server is affected by multiple vulnerabilities.
File : mariadb_5_5_29.nasl - Type : ACT_GATHER_INFO
2013-02-28 Name : The remote database server is affected by multiple vulnerabilities.
File : mariadb_5_3_12.nasl - Type : ACT_GATHER_INFO
2013-02-28 Name : The remote database server is affected by multiple vulnerabilities.
File : mariadb_5_2_14.nasl - Type : ACT_GATHER_INFO
2013-02-28 Name : The remote database server is affected by multiple vulnerabilities.
File : mariadb_5_1_67.nasl - Type : ACT_GATHER_INFO
2013-02-10 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libmysqlclient-devel-121227.nasl - Type : ACT_GATHER_INFO
2013-02-09 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-007.nasl - Type : ACT_GATHER_INFO
2013-02-04 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130131_mysql_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-02-04 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_8c773d7f6cbb11e2b242c8600054b392.nasl - Type : ACT_GATHER_INFO
2013-02-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-0219.nasl - Type : ACT_GATHER_INFO
2013-02-01 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-0219.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-0180.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130122_mysql_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-01-23 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1703-1.nasl - Type : ACT_GATHER_INFO
2013-01-23 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-0180.nasl - Type : ACT_GATHER_INFO
2013-01-18 Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_1_67.nasl - Type : ACT_GATHER_INFO
2013-01-18 Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_5_29.nasl - Type : ACT_GATHER_INFO
2013-01-14 Name : The remote Fedora host is missing a security update.
File : fedora_2012-19868.nasl - Type : ACT_GATHER_INFO
2012-12-24 Name : The remote Fedora host is missing a security update.
File : fedora_2012-19823.nasl - Type : ACT_GATHER_INFO
2012-12-17 Name : The remote Fedora host is missing a security update.
File : fedora_2012-19833.nasl - Type : ACT_GATHER_INFO
2012-12-11 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1551.nasl - Type : ACT_GATHER_INFO
2012-12-11 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1658-1.nasl - Type : ACT_GATHER_INFO
2012-12-10 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-178.nasl - Type : ACT_GATHER_INFO
2012-12-09 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1551.nasl - Type : ACT_GATHER_INFO
2012-12-08 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20121207_mysql_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-12-05 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2581.nasl - Type : ACT_GATHER_INFO
2012-12-04 Name : The remote database server is affected by a buffer overflow vulnerability.
File : mariadb_5_5_28a.nasl - Type : ACT_GATHER_INFO
2012-12-04 Name : The remote database server is affected by a buffer overflow vulnerability.
File : mariadb_5_3_11.nasl - Type : ACT_GATHER_INFO
2012-12-04 Name : The remote database server is affected by a buffer overflow vulnerability.
File : mariadb_5_2_13.nasl - Type : ACT_GATHER_INFO
2012-12-04 Name : The remote database server is affected by a buffer overflow vulnerability.
File : mariadb_5_1_66.nasl - Type : ACT_GATHER_INFO
2012-10-19 Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_5_28.nasl - Type : ACT_GATHER_INFO
2012-10-19 Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_1_66.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-02-17 11:43:17
  • Multiple Updates
2013-02-05 21:19:27
  • First insertion