VulnerabilityModified

CVE-2012-5611

EXPLOITMEDIUM 6.5EPSS 24.0%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 24.0%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command.

CVSS 2.0: 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS: 23.96% probability · 98th percentile
Public exploits: 1 in Exploit-DB · first 2 December 2012
CISA KEV: Not listed
Weakness: CWE-119
Affected: mariadb/mariadb · oracle/mysql
Source: secalert@redhat.com

EPSS trend

EPSS 24.0% since 4 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

Public exploits (1)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-23075 source ↗	MySQL (Linux) - Stack Buffer Overrun (PoC)linux · kingcope	dos	2 December 2012	no

References

http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00013.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00020.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-09/msg00010.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1551.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0180.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2012/Dec/4Mailing List, Third Party Advisory
http://secunia.com/advisories/51443Broken Link
http://secunia.com/advisories/53372Broken Link
http://security.gentoo.org/glsa/glsa-201308-06.xmlThird Party Advisory
http://www.debian.org/security/2012/dsa-2581Third Party Advisory
http://www.exploit-db.com/exploits/23075Third Party Advisory, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/12/02/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/12/02/4Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.htmlThird Party Advisory
http://www.ubuntu.com/usn/USN-1658-1Third Party Advisory
http://www.ubuntu.com/usn/USN-1703-1Third Party Advisory
https://kb.askmonty.org/en/mariadb-5166-release-notes/Third Party Advisory
https://kb.askmonty.org/en/mariadb-5213-release-notes/Third Party Advisory
https://kb.askmonty.org/en/mariadb-5311-release-notes/Third Party Advisory
https://kb.askmonty.org/en/mariadb-5528a-release-notes/Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16395Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.htmlMailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.