sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mysql. | Aug 30, 2017 | May 3, 2012 |
| Gentoo Linux | — | Upgrade dev-db/mysql. | Oct 30, 2017 | Jun 26, 2012 |
| Mysql | — | — | Jun 19, 2012 | Jun 9, 2012 |
| Oracle Mysql | — | Upgrade to Oracle MySQL version 5.5.24Upgrade to Oracle MySQL version 5.1.63Upgrade to Oracle MySQL version 5.6.6 | Aug 26, 2012 | Jun 26, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 9, 2012 |
| Suse | — | Upgrade mysql-cluster-ndb-managementUpgrade mysql-community-server-debug-debuginfoUpgrade libmysqlclient18-32bitUpgrade mysql-cluster-debug-debuginfoUpgrade mysql-cluster-ndb-tools-debuginfoUpgrade mysql-cluster-testUpgrade mysql-cluster-ndb-extraUpgrade mysql-cluster-ndb-extra-debuginfoUpgrade mysql-cluster-ndb-management-debuginfoUpgrade mysql-cluster-debuginfoUpgrade libmysqlclusterclient16Upgrade libmysqlclient_r18-x86Upgrade mysql-community-server-debugUpgrade mysql-community-server-toolsUpgrade mysql-cluster-ndb-storageUpgrade libmysqlclient18-debuginfo-32bitUpgrade libmysqlclient18-x86Upgrade mysql-cluster-debugUpgrade libmysqlclient_r18Upgrade mysql-cluster-test-debuginfoUpgrade mysql-community-serverUpgrade mysql-cluster-debugsourceUpgrade mysql-cluster-tools-debuginfoUpgrade mysql-community-server-clientUpgrade mysql-community-server-debuginfoUpgrade libmysqld18Upgrade libmysqlclusterclient16-debuginfoUpgrade mysql-cluster-toolsUpgrade libmysqlclient-develUpgrade mysql-cluster-ndb-storage-debuginfoUpgrade libmysqlclusterclient_r16Upgrade libmysqlclient18Upgrade mysql-community-server-client-debuginfoUpgrade mysql-community-server-debugsourceUpgrade libmysqlclient18-debuginfo-x86-debuginfoUpgrade libmysqld18-debuginfoUpgrade mysql-cluster-client-debuginfoUpgrade mysql-cluster-bench-debuginfoUpgrade libmysqld-develUpgrade libmysqlclient_r18-32bitUpgrade mysql-community-server-bench-debuginfoUpgrade mysql-community-server-tools-debuginfoUpgrade mysql-community-server-testUpgrade libmysqlclusterclient_r16-debuginfoUpgrade mysql-community-server-test-debuginfoUpgrade libmysqlclient18-debuginfoUpgrade mysql-clusterUpgrade mysql-community-server-benchUpgrade mysql-cluster-benchUpgrade libmysqlclient18-debuginfo-x86Upgrade mysql-cluster-ndb-toolsUpgrade mysql-cluster-clientUpgrade libmysqlclient-devel-32bit | Feb 17, 2015 | Jun 26, 2012 |
| Ubuntu | — | Upgrade mysql-server-5.1Upgrade mysql-server-5.5Upgrade mysql-server-5.0 | Nov 8, 2024 | Jun 26, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub