CVE-2008-3963
MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' ...
4.0 MediumPublic exploit
CVE-2008-3963 is a medium vulnerability (CVSS 4.0) in Mysql, published September 10, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.46%, the 93rd percentile. No source names a fixed version.
- Severity
- 4.0 MediumCVSS 2.0, NVD
- Exploit chance
- 6.46%EPSS, 93rd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.
Exploit likelihood
6.46%Down 4.4 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql-dfsg-5.0Debian:4.0 From an advisory covering 2 CVEs | before 5.0.32-7etch10, plus listed versions 5.0.32-7etch15.0.32-7etch35.0.32-7etch3~bpo31+15.0.32-7etch45.0.32-7etch55.0.32-7etch5~bpo31+15.0.32-7etch65.0.32-7etch8 | 5.0.32-7etch10 |
mysql-dfsg-5.0Debian:5.0 From an advisory covering 2 CVEs | before 5.0.51a-24+lenny1, plus listed versions 5.0.51a-235.0.51a-245.0.51a-24+lenny1~bpo40+15.0.51a-24~bpo40+1 | 5.0.51a-24+lenny1 |
httpdRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:2.2.11-2.el5s2 | 0:2.2.11-2.el5s2 |
httpd-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:2.2.11-2.el5s2 | 0:2.2.11-2.el5s2 |
httpd-develRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:2.2.11-2.el5s2 | 0:2.2.11-2.el5s2 |
httpd-manualRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:2.2.11-2.el5s2 | 0:2.2.11-2.el5s2 |
mod_jkRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:1.2.28-2.el5s2 | 0:1.2.28-2.el5s2 |
mod_jk-ap20Red Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:1.2.28-2.el5s2 | 0:1.2.28-2.el5s2 |
mod_jk-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:1.2.28-2.el5s2 | 0:1.2.28-2.el5s2 |
mod_sslRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 1:2.2.11-2.el5s2 | 1:2.2.11-2.el5s2 |
Show 65 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mysqlRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-benchRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-clusterRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-connector-odbcRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:3.51.27r695-1.el5s2 | 0:3.51.27r695-1.el5s2 |
mysql-connector-odbc-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:3.51.27r695-1.el5s2 | 0:3.51.27r695-1.el5s2 |
mysql-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-develRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-libsRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-serverRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
mysql-testRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.0.79-2.el5s2 | 0:5.0.79-2.el5s2 |
perl-DBD-MySQLRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:4.010-1.el5s2 | 0:4.010-1.el5s2 |
perl-DBD-MySQL-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:4.010-1.el5s2 | 0:4.010-1.el5s2 |
perl-DBD-PgRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:1.49-5.el5s2 | 0:1.49-5.el5s2 |
perl-DBD-Pg-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:1.49-5.el5s2 | 0:1.49-5.el5s2 |
phpRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-bcmathRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-cliRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-commonRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-dbaRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-develRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-gdRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-imapRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-ldapRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-mbstringRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-mysqlRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-ncursesRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-odbcRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-pdoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-pgsqlRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-snmpRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-soapRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-xmlRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
php-xmlrpcRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:5.2.9-2.el5s2 | 0:5.2.9-2.el5s2 |
postgresqlRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-contribRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-develRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-docsRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-jdbcRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.509-2jpp.el5s2 | 0:8.2.509-2jpp.el5s2 |
postgresql-jdbc-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.509-2jpp.el5s2 | 0:8.2.509-2jpp.el5s2 |
postgresql-libsRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-plperlRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-plpythonRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-pltclRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-pythonRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-serverRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-tclRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresql-testRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.2.13-2.el5s2 | 0:8.2.13-2.el5s2 |
postgresqlclient81Red Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.1.17-1.el5s2 | 0:8.1.17-1.el5s2 |
postgresqlclient81-debuginfoRed Hat:rhel_application_stack:2 From an advisory covering 5 CVEs | before 0:8.1.17-1.el5s2 | 0:8.1.17-1.el5s2 |
mysqlRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-benchRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-serverRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-testRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysqlRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysqlRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-benchRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-develRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-serverRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
mysql-testRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.0.77-3.el5 | 0:5.0.77-3.el5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MySQL 6.0.4 - Empty Binary String Literal Remote Denial of Service | 2008-03-28 |
What each source reports
NVD Score used
MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.
- Record
CVE-2008-3963- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE ListNo score
MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.
- Record
CVE-2008-3963- Updated
- 2026-11-02
EUVDEUVD-2008-3948No score
MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.
- Record
EUVD-2008-3948- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hp64-jg7m-f9mqNo score
MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' ...
MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.
- Record
GHSA-hp64-jg7m-f9mq- Weakness
- CWE-134
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugs.mysql.com/bug.php?id=35658
mandriva.com/security/advisories?name=MDVSA-2009:094
dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html
ubuntu.com/usn/USN-1397-1
redhat.com/support/errata/RHSA-2009-1067.html
Show 66 moreShow less
openwall.com/lists/oss-security/2008/09/09/7
vupen.com/english/advisories/2008/2554
bugs.gentoo.org/237166
exchange.xforce.ibmcloud.com/vulnerabilities/45042
debian.org/security/2009/dsa-1783
secunia.com/advisories/32769
lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
securitytracker.com/id?1020858
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10521
nvd.nist.gov/vuln/detail/CVE-2008-3963
github.com/advisories/GHSA-hp64-jg7m-f9mq
access.redhat.com/errata/RHSA-2009:1067
bugzilla.redhat.com/show_bug.cgi?id=454077
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1067.json
cve.org/CVERecord?id=CVE-2008-3963