{"id":"CVE-2012-5614","aliases":["EUVD-2012-5500","GHSA-g68p-rgrw-xp3p","RHSA-2013:0772"],"status":"published","title":"Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other...","description":"Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.13175,"percentile":0.96391,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2012-12-03T11:00:00Z","modified":"2026-06-26T12:21:44Z","exploits":[{"source":"exploitdb","id":"EDB-23078","title":"MySQL - Denial of Service (PoC)","type":"dos","platform":"linux","date":"2012-12-02","url":"https://www.exploit-db.com/exploits/23078"}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mysql-bench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mysql-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mysql-embedded-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mysql-bench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mysql-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mysql-embedded-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mysql-bench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mysql-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mysql-embedded-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mysql-bench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mysql-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mysql-embedded-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.69-1.el6_4"}]}],"bundled":15}],"products":[{"vendor":"mariadb","product":"mariadb"},{"vendor":"oracle","product":"mysql"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"http://www.securitytracker.com/id?1027829","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://secunia.com/advisories/53372","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable"]},{"url":"http://www.openwall.com/lists/oss-security/2012/12/02/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-201308-06.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2012/12/02/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0772.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2012/Dec/7","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=882607","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report"]},{"url":"https://mariadb.atlassian.net/browse/MDEV-3910","tags":["x_refsource_MISC","x_transferred","Broken Link","Patch"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5614","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g68p-rgrw-xp3p"},{"url":"https://access.redhat.com/errata/RHSA-2013:0772","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html#AppendixMSQL","tags":["article"]},{"url":"http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-68.html","tags":["article"]},{"url":"http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-69.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952863","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952864","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952869","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952874","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952876","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952895","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952899","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0772.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5614","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1506","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1506","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1521","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1531","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1531","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1532","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1532","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1544","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1548","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1548","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1552","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1552","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1555","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1555","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2375","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2378","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2389","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2389","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2391","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2391","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2392","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-3808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=985699","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3808","tags":["advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html#AppendixMSQL","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2012-5614","description":"Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.","status":"published","published":"2012-12-03T11:00:00Z","modified":"2024-08-06T21:14:16.017Z","updated_at":"2026-11-02T14:34:49.246229Z"}],"euvd":[{"id":"EUVD-2012-5500","description":"Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.","status":"published","published":"2012-12-03T11:00:00Z","modified":"2024-08-06T21:14:16Z","updated_at":"2026-11-03T01:56:04.46975Z"}],"ghsa":[{"id":"GHSA-g68p-rgrw-xp3p","title":"Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other...","description":"Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.","status":"published","published":"2022-05-17T04:52:31Z","modified":"2023-02-03T05:06:32Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:53:55.296222Z"}],"nvd":[{"id":"CVE-2012-5614","description":"Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.","status":"published","published":"2012-12-03T12:49:43.783Z","modified":"2026-06-16T23:47:05.58Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:16.958223Z"}],"osv":[{"id":"RHSA-2013:0772","title":"Red Hat Security Advisory: mysql security update","status":"published","published":"2024-09-15T20:48:54Z","modified":"2026-06-26T12:21:44.303716975Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}