CVE-2012-5611: mariadb
Vulnerability summary
CVE-2012-5611 is a medium (CVSS 6.5) vulnerability in mariadb. EPSS estimates a 23.96% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Duplicates 1 · Related 3Timeline
- 03-12-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
23.96%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 23.96% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMySQL (Linux) - Stack Buffer Overrun (PoC)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- mysql< 0:5.1.66-2.el6_3
- mysql-bench< 0:5.1.66-2.el6_3
- mysql-debuginfo< 0:5.1.66-2.el6_3
- mysql-devel< 0:5.1.66-2.el6_3
- mysql-embedded< 0:5.1.66-2.el6_3
Mariadb1 product
- mariadbEOL5.1.41 | 5.1.42 | 5.1.44 | 5.1.47 | 5.1.49 | 5.1.50 | 5.1.51 | 5.1.53 | 5.1.55 | 5.1.60 | 5.1.61 | 5.1.62 | 5.2.0 | 5.2.1 | 5.2.2 | 5.2.3 | 5.2.4 | 5.2.5 | 5.2.6 | 5.2.7 | 5.2.8 | 5.2.9 | 5.2.10 | 5.2.11 | 5.2.12 | 5.3.0 | 5.3.1 | 5.3.2 | 5.3.3 | 5.3.4 | 5.3.5 | 5.3.6 | 5.3.7 | 5.3.8 | 5.3.9 | 5.3.10 | 5.5.20 | 5.5.21 | 5.5.22 | 5.5.23 | 5.5.24 | 5.5.25 | 5.5.27 | 5.5.28
Oracle1 product
- mysqlEOL5.1.53 | 5.5.19
3 vendors · 11 products
References
34 links- lists.opensuse.org/opensuse-security-announce/2013-01/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2013:102Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-01/msg00020.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-01/msg00013.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpujan2013-1515902.htmlX Refsource CONFIRMThird Party Advisory
Show all 34 references
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-updates/2013-09/msg00010.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16395VDB EntrySignatureX Refsource OVALThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2013:150Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
