--- title: "CVE-2012-4414\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2012-4414?format=md keywords: index, follow --- # CVE-2012-4414 Publication date 22 January 2013 Last updated 4 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete. [Read the notes from the security team](https://ubuntu.com/security/CVE-2012-4414?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | mysql-5.1 | 13.04 raring | Not in release | | 12.10 quantal | Not in release | | 12.04 LTS precise | Not in release | | 11.10 oneiric | Fixed 5.1.69-0ubuntu0.11.10.1 | | 11.04 natty | Ignored end of life | | 10.04 LTS lucid | Not in release | | 8.04 LTS hardy | Not in release | | mysql-5.5 | 13.04 raring | Fixed 5.5.31-0ubuntu0.13.04.1 | | 12.10 quantal | Fixed 5.5.31-0ubuntu0.12.10.1 | | 12.04 LTS precise | Fixed 5.5.31-0ubuntu0.12.04.1 | | 11.10 oneiric | Not in release | | 11.04 natty | Not in release | | 10.04 LTS lucid | Not in release | | 8.04 LTS hardy | Not in release | | mysql-cluster-7.0 | 13.04 raring | Not in release | | 12.10 quantal | Not in release | | 12.04 LTS precise | Not in release | | 11.10 oneiric | Ignored | | 11.04 natty | Ignored | | 10.04 LTS lucid | Ignored | | 8.04 LTS hardy | Not in release | | mysql-dfsg-5.0 | 13.04 raring | Not in release | | 12.10 quantal | Not in release | | 12.04 LTS precise | Not in release | | 11.10 oneiric | Not in release | | 11.04 natty | Not in release | | 10.04 LTS lucid | Not in release | | 8.04 LTS hardy | Ignored end of life | | mysql-dfsg-5.1 | 13.04 raring | Not in release | | 12.10 quantal | Not in release | | 12.04 LTS precise | Not in release | | 11.10 oneiric | Not in release | | 11.04 natty | Not in release | | 10.04 LTS lucid | Fixed 5.1.69-0ubuntu0.10.04.1 | | 8.04 LTS hardy | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [jdstrand](https://launchpad.net/~jdstrand) mysql-cluster-7.0 not supported per Ubuntu Server team As of 2012/01/09, Oracle no longer supports MySQL 5.0. Unfortunately, because of upstream update and commit policies it is not possible to backport patches from later releases. Ubuntu is regrettably unable to support MySQL 5.0 and users are encouraged to upgrade to Ubuntu 10.04 LTS or later. --- ### [mdeslaur](https://launchpad.net/~mdeslaur) incomplete fix in 5.5.29, see: http://www.mysqlperformanceblog.com/2013/01/13/cve-2012-4414-in-mysql-5-5-29-and-percona-server-5-5-29/ --- ### [jdstrand](https://launchpad.net/~jdstrand) watch for fix in 5.5.31 Debian released 5.5.30+dfsg-1 claiming to have fixed this issue as of 2013-03-25, no complete fix from upstream --- ### [seth-arnold](https://launchpad.net/~seth-arnold) Not actually fixed in 1807-1 -- my mistake ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4414) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2012-4414) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2012-4414) * [Debian](https://security-tracker.debian.org/tracker/CVE-2012-4414) ### Other references * *