CVE-2009-0819

sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion failure.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://bugs.mysql.com/bug.php?id=42495	Patch Vendor Advisory
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-32.html	Vendor Advisory
http://dev.mysql.com/doc/refman/6.0/en/news-6-0-10.html
http://secunia.com/advisories/34115	Vendor Advisory
http://www.securityfocus.com/bid/33972	Exploit
http://www.securitytracker.com/id?1021786
http://www.vupen.com/english/advisories/2009/0594	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49050
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7544

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mysql:mysql::::::::
	cpe:2.3:a:mysql:mysql:5.1.23:::::::*
	cpe:2.3:a:mysql:mysql:5.1.31:::::::*
	cpe:2.3:a:mysql:mysql:6.0.9:::::::*
	cpe:2.3:a:mysql:mysql:6.0.10-bzr:::::::*
	cpe:2.3:a:oracle:mysql:5.1:::::::*
	cpe:2.3:a:oracle:mysql:5.1.1:::::::*
	cpe:2.3:a:oracle:mysql:5.1.2:::::::*
	cpe:2.3:a:oracle:mysql:5.1.3:::::::*
	cpe:2.3:a:oracle:mysql:5.1.10:::::::*
	cpe:2.3:a:oracle:mysql:5.1.11:::::::*
	cpe:2.3:a:oracle:mysql:5.1.12:::::::*
	cpe:2.3:a:oracle:mysql:5.1.13:::::::*
	cpe:2.3:a:oracle:mysql:5.1.14:::::::*
	cpe:2.3:a:oracle:mysql:5.1.15:::::::*
	cpe:2.3:a:oracle:mysql:5.1.16:::::::*
	cpe:2.3:a:oracle:mysql:5.1.17:::::::*
	cpe:2.3:a:oracle:mysql:5.1.18:::::::*
	cpe:2.3:a:oracle:mysql:5.1.19:::::::*
	cpe:2.3:a:oracle:mysql:5.1.20:::::::*
	cpe:2.3:a:oracle:mysql:5.1.21:::::::*
	cpe:2.3:a:oracle:mysql:5.1.22:::::::*
	cpe:2.3:a:oracle:mysql:5.1.23:a::::::
	cpe:2.3:a:oracle:mysql:5.1.24:::::::*
	cpe:2.3:a:oracle:mysql:5.1.25:::::::*
	cpe:2.3:a:oracle:mysql:5.1.26:::::::*
	cpe:2.3:a:oracle:mysql:5.1.27:::::::*
	cpe:2.3:a:oracle:mysql:5.1.28:::::::*
	cpe:2.3:a:oracle:mysql:5.1.29:::::::*
	cpe:2.3:a:oracle:mysql:5.1.30:::::::*
	cpe:2.3:a:oracle:mysql:5.1.31:sp1::::::
	cpe:2.3:a:oracle:mysql:6.0.0:::::::*
	cpe:2.3:a:oracle:mysql:6.0.1:::::::*
	cpe:2.3:a:oracle:mysql:6.0.2:::::::*
	cpe:2.3:a:oracle:mysql:6.0.3:::::::*
	cpe:2.3:a:oracle:mysql:6.0.4:::::::*

History

No history.

Information

Published : 2009-03-05 02:30

Updated : 2019-12-17 20:23

NVD link : CVE-2009-0819

Mitre link : CVE-2009-0819

CVE.ORG link : CVE-2009-0819

JSON object : View

Products Affected

mysql

mysql

oracle

mysql

CWE

NVD-CWE-Other

4.0 /10