$ cve CVE-2012-5612 JSON

CVE-2012-5612 EXPLOIT

6.5

MEDIUM · CVSS 2.0 · EPSS 20.8% (pctl 97)

Patch early

A public exploit exists.

Description

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.

Scoring

CVSS	6.5 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS	20.84% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-787
On CISA KEV	no
Public exploit	yes
Published	2012-12-03
Last modified	2026-06-16

Affected (6)

Vendor	Product
canonical	ubuntu linux
mariadb	mariadb
oracle	mysql
suse	linux enterprise desktop
suse	linux enterprise server
suse	linux enterprise software development kit

Public exploits

Source	Title	Date
exploit-db	MySQL (Linux) - Heap Overrun (PoC)	2012-12-02

References

→ the Explorer · watch your stack · NVD