CVE-2006-3469
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April...
CVE-2006-3469 is a medium vulnerability (CVSS 4.0) in Mysql, published July 18, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 31.1%, the 98th percentile. Fixed in mysql-dfsg-4.1 4.1.11a-4sarge5.
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later used in a formatted print call to display the error message.
Exploit likelihood
What each source reports
NVD Score used
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later used in a formatted print call to display the error message.
- Record
CVE-2006-3469- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later used in a formatted print call to display the error message.
- Record
CVE-2006-3469- Updated
- 2026-11-02
EUVDEUVD-2006-3464 No score
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later used in a formatted print call to display the error message.
- Record
EUVD-2006-3464- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vx28-8m2j-873p No score
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April...
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later used in a formatted print call to display the error message.
- Record
GHSA-vx28-8m2j-873p- Weakness
- CWE-134
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mysql-dfsg-4.1Debian:3.1 |
before 4.1.11a-4sarge5, plus listed versions 4.1.11a-44.1.11a-4sarge14.1.11a-4sarge24.1.11a-4sarge34.1.11a-4sarge4 |
4.1.11a-4sarge5 |
mysqlRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-benchRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-debuginfoRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-develRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-serverRed Hat:enterprise_linux:4::as |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysqlRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-benchRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-develRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mysql-serverRed Hat:enterprise_linux:4::desktop |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysqlRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-benchRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-debuginfoRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-develRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-serverRed Hat:enterprise_linux:4::es |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysqlRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-benchRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-develRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
mysql-serverRed Hat:enterprise_linux:4::ws |
before 0:4.1.22-2.el4 | 0:4.1.22-2.el4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MySQL 4.x/5.x - Server Date_Format Denial of Service | 2006-07-18 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
us-cert.gov/cas/techalerts/TA07-072A.html
security.gentoo.org/glsa/glsa-200608-09.xml
securityfocus.com/bid/19032
lists.apple.com/archives/security-announce/2007/Mar/msg00002.html
secunia.com/advisories/31226
docs.info.apple.com/article.html?artnum=305214
Show 34 moreShow less
redhat.com/support/errata/RHSA-2008-0768.html
ubuntu.com/usn/usn-321-1
bugs.mysql.com/bug.php?id=20729
bugs.debian.org/cgi-bin/bugreport.cgi?bug=375694
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9827
dev.mysql.com/doc/refman/4.1/en/news-4-1-21.html
debian.org/security/2006/dsa-1112
vupen.com/english/advisories/2007/0930
nvd.nist.gov/vuln/detail/CVE-2006-3469
github.com/advisories/GHSA-vx28-8m2j-873p
access.redhat.com/errata/RHSA-2008:0768
bugzilla.redhat.com/show_bug.cgi?id=201904
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0768.json
cve.org/CVERecord?id=CVE-2006-3469