MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade mysqlUpgrade mysql-testUpgrade mysql-benchUpgrade mysql-serverUpgrade mysql-devel | Oct 16, 2024 | Feb 27, 2006 |
| Suse | — | Upgrade mysqlUpgrade liblz4-1Upgrade mariadb104-toolsUpgrade libmysql55client_r18-32bitUpgrade libmysqlclient-develUpgrade libmariadb-develUpgrade mariadb104-clientUpgrade libmysqlclient15-x86Upgrade mariadb-clientUpgrade mariadb104-benchUpgrade python3-mysqlclientUpgrade mariadb-errormessagesUpgrade libmysql55client18Upgrade mariadb104Upgrade libmysql55client18-32bitUpgrade libmysql55client_r18Upgrade mariadb104-testUpgrade libmysqlclient_r15-x86Upgrade libmysqlclient15-32bitUpgrade mariadb104-errormessagesUpgrade mariadb104-galeraUpgrade libmariadbd19Upgrade mariadbUpgrade libmysql55client18-x86Upgrade libmariadbd-develUpgrade mysql-MaxUpgrade mariadb-toolsUpgrade libmysql55client_r18-x86Upgrade mysql-clientUpgrade libmysqlclient_r15-32bitUpgrade libmariadbd104-develUpgrade mariadb104-rpm-macrosUpgrade mariadb-benchUpgrade libmariadb_pluginsUpgrade libmariadb3Upgrade libmysqlclient_r15Upgrade libmysqlclient15Upgrade mysql-tools | Aug 9, 2024 | Jun 27, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub