Your submission was sent successfully! Close

CVE-2012-4414

Published: 22 January 2013

Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.

Notes

AuthorNote
jdstrand
mysql-cluster-7.0 not supported per Ubuntu Server team
As of 2012/01/09, Oracle no longer supports MySQL 5.0.
Unfortunately, because of upstream update and commit policies it is not
possible to backport patches from later releases. Ubuntu is regrettably
unable to support MySQL 5.0 and users are encouraged to upgrade to Ubuntu
10.04 LTS or later.
mdeslaur
incomplete fix in 5.5.29, see:
http://www.mysqlperformanceblog.com/2013/01/13/cve-2012-4414-in-mysql-5-5-29-and-percona-server-5-5-29/
jdstrand
watch for fix in 5.5.31
Debian released 5.5.30+dfsg-1 claiming to have fixed this issue
as of 2013-03-25, no complete fix from upstream
seth-arnold
Not actually fixed in 1807-1 -- my mistake
Priority

Medium

Status

Package Release Status
mysql-5.1
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Does not exist

natty Ignored
(reached end-of-life)
oneiric
Released (5.1.69-0ubuntu0.11.10.1)
precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

upstream Needs triage

mysql-5.5
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Does not exist

natty Does not exist

oneiric Does not exist

precise
Released (5.5.31-0ubuntu0.12.04.1)
quantal
Released (5.5.31-0ubuntu0.12.10.1)
raring
Released (5.5.31-0ubuntu0.13.04.1)
saucy
Released (5.5.31-0ubuntu0.13.04.1)
upstream
Released (5.5.30+dfsg-1)
mysql-cluster-7.0
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Ignored

natty Ignored

oneiric Ignored

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

upstream Needs triage

mysql-dfsg-5.0
Launchpad, Ubuntu, Debian
hardy Ignored
(see note)
lucid Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

upstream Needs triage

mysql-dfsg-5.1
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid
Released (5.1.69-0ubuntu0.10.04.1)
natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

upstream Needs triage