PT-2013-3439 · Mariadb+2 · Mariadb+3

Alyssa Milburn · Published 2013-03-28 · Updated 2022-08-04 · CVE-2013-1861

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MariaDB versions 5.1.x through 5.1.67 MariaDB versions 5.2.x through 5.2.14 MariaDB versions 5.3.x through 5.3.12 MariaDB versions 5.5.x through 5.5.29 Oracle MySQL versions 5.1.x through 5.1.69 Oracle MySQL versions 5.5.x through 5.5.31 Oracle MySQL versions 5.6.x through 5.6.11

Description The issue allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points. This is due to a numeric calculation error when processing the binary representation of this feature.

Recommendations For MariaDB versions 5.1.x through 5.1.67, update to version 5.1.68 or later. For MariaDB versions 5.2.x through 5.2.14, update to version 5.2.15 or later. For MariaDB versions 5.3.x through 5.3.12, update to version 5.3.13 or later. For MariaDB versions 5.5.x through 5.5.29, update to version 5.5.30 or later. For Oracle MySQL versions 5.1.x through 5.1.69, update to a version later than 5.1.69. For Oracle MySQL versions 5.5.x through 5.5.31, update to a version later than 5.5.31. For Oracle MySQL versions 5.6.x through 5.6.11, update to a version later than 5.6.11.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-1861

DSA-2780-1

DSA-2818-1

SUSE-SU-2013_1390-1

Affected Products

Mariadb

Mariadb Server

Mysql Server

Suse

References · 69

• 🔥 http://securityfocus.com/bid/58511 · Exploit
• 🔥 https://exploit-db.com/exploits/38392 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1861 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3798 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3808 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2013-10/msg00001.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3795 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3811 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3794 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3810 · Security Note
• http://debian.org/security/2013/dsa-2818 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3812 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3806 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00022.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3801 · Security Note