Multiple vulnerabilities in Google, mysql
Security Bulletin
This security bulletin contains information about 8 vulnerabilities.
1) Buffer overflow
EUVDB-ID: #VU43240
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2012-0882
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17. NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.
MitigationInstall update from vendor's website.
Vulnerable software versionsmysql: 5.1 - 5.5.21
CPE2.3- cpe:2.3::google:mysql:5.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.1.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.1.2:*:*:*:*:*:*:*
https://www.openwall.com/lists/oss-security/2012/02/24/2
https://blogs.oracle.com/sunsecurity/entry/cve_2012_0882buffer_overflow_vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=789141
https://lists.immunityinc.com/pipermail/canvas/2012-February/000011.html
https://lists.immunityinc.com/pipermail/canvas/2012-February/000014.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Buffer overflow
EUVDB-ID: #VU43710
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2012-2102
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote #AU# to perform service disruption.
MySQL 5.1.x before 5.1.62 and 5.5.x before 5.5.22 allows remote authenticated users to cause a denial of service (assertion failure and mysqld abort) by deleting a record and using HANDLER READ NEXT.
MitigationInstall update from vendor's website.
Vulnerable software versionsmysql: 5.1 - 5.5.21
CPE2.3- cpe:2.3::google:mysql:5.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.1.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.1.2:*:*:*:*:*:*:*
https://bazaar.launchpad.net/~mysql/mysql-server/5.5/revision/3097.15.15
https://dev.mysql.com/doc/refman/5.1/en/news-5-1-62.html
https://dev.mysql.com/doc/refman/5.5/en/news-5-5-22.html
https://eromang.zataz.com/2012/04/10/oracle-mysql-innodb-bugs-13510739-and-63775-dos-demo/
https://secunia.com/advisories/53372
https://security.gentoo.org/glsa/glsa-201308-06.xml
https://www.openwall.com/lists/oss-security/2012/04/13/7
https://www.securityfocus.com/bid/52931
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Input validation error
EUVDB-ID: #VU44375
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2012-0484
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote #AU# to gain access to sensitive information.
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect confidentiality via unknown vectors.
MitigationInstall update from vendor's website.
Vulnerable software versionsmysql: 5.0.0 - 5.5.21
CPE2.3- cpe:2.3::google:mysql:5.0.0:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.0.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.0.2:*:*:*:*:*:*:*
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687
https://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html
https://osvdb.org/78372
https://secunia.com/advisories/48250
https://secunia.com/advisories/53372
https://security.gentoo.org/glsa/glsa-201308-06.xml
https://www.debian.org/security/2012/dsa-2429
https://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
https://www.securityfocus.com/bid/51515
https://www.ubuntu.com/usn/USN-1397-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/72525
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Input validation error
EUVDB-ID: #VU44376
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2012-0485
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote #AU# to perform service disruption.
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, and CVE-2012-0492.
MitigationInstall update from vendor's website.
Vulnerable software versionsmysql: 5.1 - 5.5.21
CPE2.3- cpe:2.3::google:mysql:5.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.1.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.1.2:*:*:*:*:*:*:*
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687
https://osvdb.org/78383
https://secunia.com/advisories/48250
https://secunia.com/advisories/53372
https://security.gentoo.org/glsa/glsa-201308-06.xml
https://www.debian.org/security/2012/dsa-2429
https://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
https://www.securityfocus.com/bid/51513
https://www.ubuntu.com/usn/USN-1397-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/72526
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Input validation error
EUVDB-ID: #VU44377
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2012-0486
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495.
MitigationInstall update from vendor's website.
Vulnerable software versionsmysql: 5.5.0 - 5.5.21
CPE2.3- cpe:2.3::google:mysql:5.5.0:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.5.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.5.2:*:*:*:*:*:*:*
https://osvdb.org/78384
https://secunia.com/advisories/53372
https://security.gentoo.org/glsa/glsa-201308-06.xml
https://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
https://www.securityfocus.com/bid/51514
https://www.ubuntu.com/usn/USN-1397-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/72527
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Input validation error
EUVDB-ID: #VU44378
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2012-0487
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote #AU# to perform service disruption.
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495.
MitigationInstall update from vendor's website.
Vulnerable software versionsmysql: 5.5.0 - 5.5.21
CPE2.3- cpe:2.3::google:mysql:5.5.0:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.5.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.5.2:*:*:*:*:*:*:*
https://osvdb.org/78385
https://secunia.com/advisories/53372
https://security.gentoo.org/glsa/glsa-201308-06.xml
https://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
https://www.securityfocus.com/bid/51503
https://www.ubuntu.com/usn/USN-1397-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/72528
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Input validation error
EUVDB-ID: #VU44379
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2012-0488
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote #AU# to perform service disruption.
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0487, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495.
MitigationInstall update from vendor's website.
Vulnerable software versionsmysql: 5.5.0 - 5.5.21
CPE2.3- cpe:2.3::google:mysql:5.5.0:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.5.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.5.2:*:*:*:*:*:*:*
https://osvdb.org/78386
https://secunia.com/advisories/53372
https://security.gentoo.org/glsa/glsa-201308-06.xml
https://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
https://www.securityfocus.com/bid/51506
https://www.ubuntu.com/usn/USN-1397-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/72529
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Input validation error
EUVDB-ID: #VU44380
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2012-0489
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote #AU# to perform service disruption.
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495.
MitigationInstall update from vendor's website.
Vulnerable software versionsmysql: 5.5.0 - 5.5.21
CPE2.3- cpe:2.3::google:mysql:5.5.0:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.5.1:*:*:*:*:*:*:*
- cpe:2.3::google:mysql:5.5.2:*:*:*:*:*:*:*
https://osvdb.org/78387
https://secunia.com/advisories/53372
https://security.gentoo.org/glsa/glsa-201308-06.xml
https://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
https://www.securityfocus.com/bid/51510
https://www.ubuntu.com/usn/USN-1397-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/72530
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
