Every CVE Search/ Get API key

CVE-2012-5611

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions...

6.5 MediumPublic exploitFix available

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.

Exploit likelihood

24.0%Down 19.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.

Record
CVE-2012-5611
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.

Record
CVE-2012-5611
Updated
2026-11-02
EUVDEUVD-2012-5497 No score

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.

Record
EUVD-2012-5497
Updated
2026-11-03
GitHub AdvisoriesGHSA-gcrp-g698-23xq No score

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions...

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.

Record
GHSA-gcrp-g698-23xq
Weakness
CWE-119
Updated
2026-11-02
OSVopenSUSE-SU-2024:10153-1 No score

libmysqlclient-devel-10.0.22-3.8 on GA media

These are all security issues fixed in the libmysqlclient-devel-10.0.22-3.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10153-1
Updated
2026-11-02
OSVSUSE-RU-2023:3956-1 No score

Recommended update for mariadb104

This update for mariadb104 fixes the following issues:

  • Implement version 10.4 of MariaDB (jsc#PED-2455):
    • It is possible to use more than one authentication plugin for each user account.
    • The root user account is being created with the ability to use two authentication plugins.
    • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
    • Is being supported for User Password Expiry, which is not active by default.
    • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
  • Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
  • MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
  • Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
  • Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)
Record
SUSE-RU-2023:3956-1
Updated
2026-11-02
OSVSUSE-RU-2023:4991-1 No score

Recommended update for mariadb104

This update for mariadb104 fixes the following issues:

  • Implement version 10.4 of MariaDB (jsc#PED-2455):
    • It is possible to use more than one authentication plugin for each user account.
    • The root user account is being created with the ability to use two authentication plugins.
    • All user accounts, passwords, and global privileges are now stored in the mysql.global_priv table.
    • Is being supported for User Password Expiry, which is not active by default.
    • Faster privilege checks for MariaDB setups with many user accounts or many database grants.
  • Update mysql-systemd-helper to be aware of custom group (bsc#1200105)
  • MariaDB is now support lz4 compression for 'INNODB'. (bsc#1186031)
  • Add 'mysql-user.conf' file to enable systemd generating mysql user in containers. (bsc#1173028)
  • Fixes an issue when MariaDB is ignoring the value of the parameter 'open_files_limit' in the global variables. (bsc#1180014)
Record
SUSE-RU-2023:4991-1
Updated
2026-11-02
OSVSUSE-SU-2015:1177-2 No score

Security update for MySQL

A stack-based buffer overflow in MySQL has been fixed that could have caused a Denial of Service or potentially allowed the execution of arbitrary code (CVE-2012-5611).

Security Issue references:

* CVE-2012-5615
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5615>
* CVE-2012-5615
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5615>
* CVE-2012-5613
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5613>
* CVE-2012-5612
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5612>
* CVE-2012-5611
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5611>
Record
SUSE-SU-2015:1177-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mysql-5.1
Debian:6.0
 before 5.1.66-0+squeeze1, plus listed versions
5.1.49-35.1.50-15.1.51-15.1.53-15.1.54-1
Show 17 moreShow less
5.1.54-25.1.55-15.1.56-15.1.57-15.1.57-1.15.1.57-1.25.1.57-1.35.1.57-25.1.57-35.1.57-3.15.1.58-15.1.61-0+squeeze15.1.61-25.1.61-35.1.62-15.1.62-1+m68k5.1.63-0+squeeze1
5.1.66-0+squeeze1
mysql
Red Hat:enterprise_linux:6::client
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-libs
Red Hat:enterprise_linux:6::client
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-server
Red Hat:enterprise_linux:6::client
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-bench
Red Hat:enterprise_linux:6::client
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-devel
Red Hat:enterprise_linux:6::client
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-embedded
Red Hat:enterprise_linux:6::client
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-embedded-devel
Red Hat:enterprise_linux:6::client
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-test
Red Hat:enterprise_linux:6::client
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
Show 52 moreShow less
Affected packages
PackageAffectedFixed
mysql
Red Hat:enterprise_linux:6::computenode
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-libs
Red Hat:enterprise_linux:6::computenode
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-bench
Red Hat:enterprise_linux:6::computenode
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-devel
Red Hat:enterprise_linux:6::computenode
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-embedded
Red Hat:enterprise_linux:6::computenode
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-embedded-devel
Red Hat:enterprise_linux:6::computenode
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-server
Red Hat:enterprise_linux:6::computenode
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-test
Red Hat:enterprise_linux:6::computenode
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql
Red Hat:enterprise_linux:6::server
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-bench
Red Hat:enterprise_linux:6::server
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-devel
Red Hat:enterprise_linux:6::server
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-libs
Red Hat:enterprise_linux:6::server
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-server
Red Hat:enterprise_linux:6::server
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-test
Red Hat:enterprise_linux:6::server
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-embedded
Red Hat:enterprise_linux:6::server
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-embedded-devel
Red Hat:enterprise_linux:6::server
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql
Red Hat:enterprise_linux:6::workstation
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-bench
Red Hat:enterprise_linux:6::workstation
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-devel
Red Hat:enterprise_linux:6::workstation
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-libs
Red Hat:enterprise_linux:6::workstation
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-server
Red Hat:enterprise_linux:6::workstation
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-test
Red Hat:enterprise_linux:6::workstation
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-embedded
Red Hat:enterprise_linux:6::workstation
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql-embedded-devel
Red Hat:enterprise_linux:6::workstation
 before 0:5.1.66-2.el6_3
0:5.1.66-2.el6_3
mysql
Red Hat:enterprise_linux:5::server
 before 0:5.0.95-5.el5_9
0:5.0.95-5.el5_9
mysql-bench
Red Hat:enterprise_linux:5::server
 before 0:5.0.95-5.el5_9
0:5.0.95-5.el5_9
mysql-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:5.0.95-5.el5_9
0:5.0.95-5.el5_9
mysql-devel
Red Hat:enterprise_linux:5::server
 before 0:5.0.95-5.el5_9
0:5.0.95-5.el5_9
mysql-server
Red Hat:enterprise_linux:5::server
 before 0:5.0.95-5.el5_9
0:5.0.95-5.el5_9
mysql-test
Red Hat:enterprise_linux:5::server
 before 0:5.0.95-5.el5_9
0:5.0.95-5.el5_9
mariadb104
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 10.4.30-150100.3.5.10
10.4.30-150100.3.5.10
python-mysqlclient
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 1.4.6-150100.3.3.7
1.4.6-150100.3.3.7
mariadb104
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 10.4.30-150100.3.5.10
10.4.30-150100.3.5.10
python-mysqlclient
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.4.6-150100.3.3.7
1.4.6-150100.3.3.7
mariadb104
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 10.4.30-150100.3.5.10
10.4.30-150100.3.5.10
python-mysqlclient
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.4.6-150100.3.3.7
1.4.6-150100.3.3.7
lz4
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.8.0-3.5.2
1.8.0-3.5.2
mariadb-connector-c
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.1.22-2.35.1
3.1.22-2.35.1
mariadb104
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 10.4.30-8.5.46
10.4.30-8.5.46
python-mysqlclient
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.3.14-8.9.2
1.3.14-8.9.2
lz4
SUSE:Linux Enterprise Server 12 SP5
 before 1.8.0-3.5.2
1.8.0-3.5.2
mariadb-connector-c
SUSE:Linux Enterprise Server 12 SP5
 before 3.1.22-2.35.1
3.1.22-2.35.1
mariadb104
SUSE:Linux Enterprise Server 12 SP5
 before 10.4.30-8.5.46
10.4.30-8.5.46
python-mysqlclient
SUSE:Linux Enterprise Server 12 SP5
 before 1.3.14-8.9.2
1.3.14-8.9.2
lz4
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.8.0-3.5.2
1.8.0-3.5.2
mariadb-connector-c
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.1.22-2.35.1
3.1.22-2.35.1
mariadb104
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 10.4.30-8.5.46
10.4.30-8.5.46
python-mysqlclient
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.3.14-8.9.2
1.3.14-8.9.2
mariadb
openSUSE:Tumbleweed
 before 10.0.22-3.8
10.0.22-3.8

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMySQL (Linux) - Stack Buffer Overrun (PoC)2012-12-02

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5611 is a medium vulnerability (CVSS 6.5) in Mariadb, published December 3, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.0%, the 97th percentile. Fixed in mysql-5.1 5.1.66-0+squeeze1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 265 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open