CVE-2012-0882: Buffer Overflow
Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17. NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.
Other sources
It was reported [1] that VulnDisco Pack Professional 9.17 contains a working remote 0-day exploit against MySQL 5.5.20. No further information has been provided or is currently available.
Note: Since no further detailed information is currently available about this flaw, Red Hat Security Response Team is actively investigating the progress done on this (both with upstream and the reporter) and will update this record with further information as soon as it is available.
[1] https://lists.immunityinc.com/pipermail/canvas/2012-February/000011.html
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0882?
CVE-2012-0882 is classified as a high-severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2012-0882?
To fix CVE-2012-0882, update MySQL to version 5.5.22 or later.
Which versions of MySQL are affected by CVE-2012-0882?
CVE-2012-0882 affects MySQL versions 5.5.20 and earlier as well as 5.1.x before 5.1.62.
Can CVE-2012-0882 be exploited remotely?
Yes, CVE-2012-0882 can be exploited remotely, enabling attackers to execute arbitrary code.
Is there a patch for CVE-2012-0882?
Yes, a patch is included in the MySQL updates beyond version 5.5.22.