CVE-2013-1861
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68,...
5.0 MediumPublic exploit
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
Exploit likelihood
18.8%Up 3.2 points since Feb 4, 2022
What each source reports
NVD Score used
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
- Record
CVE-2013-1861- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
- Record
CVE-2013-1861- Updated
- 2026-11-02
EUVDEUVD-2013-1864 No score
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
- Record
EUVD-2013-1864- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5cv5-75c5-879q No score
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68,...
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
- Record
GHSA-5cv5-75c5-879q- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVSUSE-SU-2015:0620-1 No score
Security update for MySQL
This MySQL update provides the following:
* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
CVE-2014-4240, CVE-2014-4214, CVE-2014-4243
See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Security Issues:
* CVE-2014-2484
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
- Record
SUSE-SU-2015:0620-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0946-1 No score
Security update for MySQL
This MySQL update provides the following:
* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
CVE-2014-4240, CVE-2014-4214, CVE-2014-4243
See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Security Issues:
* CVE-2014-2484
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
- Record
SUSE-SU-2015:0946-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1177-1 No score
Security update for MySQL
This MySQL update provides the following:
* upgrade to version 5.5.39, [bnc#887580]
* CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260,
CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233,
CVE-2014-4240, CVE-2014-4214, CVE-2014-4243
See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Security Issues:
* CVE-2014-2484
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484>
* CVE-2014-4258
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258>
* CVE-2014-4260
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260>
* CVE-2014-2494
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494>
* CVE-2014-4238
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238>
* CVE-2014-4207
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207>
* CVE-2014-4233
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233>
* CVE-2014-4240
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240>
* CVE-2014-4214
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214>
* CVE-2014-4243
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243>
- Record
SUSE-SU-2015:1177-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql-5.1Debian:6.0 From an advisory covering 32 CVEs |
before 5.1.72-2, plus listed versions 5.1.49-35.1.50-15.1.51-15.1.53-15.1.54-1 Show 18 moreShow less5.1.54-25.1.55-15.1.56-15.1.57-15.1.57-1.15.1.57-1.25.1.57-1.35.1.57-25.1.57-35.1.57-3.15.1.58-15.1.61-0+squeeze15.1.61-25.1.61-35.1.62-15.1.62-1+m68k5.1.63-0+squeeze15.1.66-0+squeeze1 |
5.1.72-2 |
mysql-5.5Debian:7 From an advisory covering 10 CVEs |
before 5.5.33+dfsg-0+wheezy1, plus listed versions 5.5.30+dfsg-1.15.5.31+dfsg-0+wheezy15.5.31+dfsg-1 |
5.5.33+dfsg-0+wheezy1 |
mysqlRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-benchRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-develRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-embeddedRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-embedded-develRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-testRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-libsRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mysql-serverRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysqlRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-benchRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-develRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-embeddedRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-embedded-develRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-serverRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-testRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-libsRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysqlRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-embeddedRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-embedded-develRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-benchRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-develRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-libsRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-serverRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-testRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysqlRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-embeddedRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-embedded-develRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-benchRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-develRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-libsRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-serverRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
mysql-testRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs |
before 0:5.1.71-1.el6 | 0:5.1.71-1.el6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MySQL / MariaDB - Geometry Query Denial of Service | 2013-03-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1861 is a medium vulnerability (CVSS 5.0) in Mariadb, published March 28, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.8%, the 97th percentile. No source names a fixed version.
References
secunia.com/advisories/54300
debian.org/security/2013/dsa-2818
seclists.org/oss-sec/2013/q1/671
oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
exchange.xforce.ibmcloud.com/vulnerabilities/82895
mariadb.atlassian.net/browse/MDEV-4252
Show 184 moreShow less
lists.opensuse.org/opensuse-updates/2013-08/msg00024.html
securityfocus.com/bid/58511
ubuntu.com/usn/USN-1909-1
lists.askmonty.org/pipermail/commits/2013-March/004371.html
osvdb.org/91415
bugzilla.redhat.com/show_bug.cgi?id=919247
security.gentoo.org/glsa/glsa-201409-04.xml
nvd.nist.gov/vuln/detail/CVE-2013-1861
github.com/advisories/GHSA-5cv5-75c5-879q
access.redhat.com/errata/RHBA-2013:1647
security.access.redhat.com/data/csaf/v2/advisories/2013/rhba-2013_1647.json
cve.org/CVERecord?id=CVE-2013-1861
suse.com/support/update/announcement/2015/suse-su-20150620-1
bugzilla.suse.com/734436