Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-2583 — Oracle Mysql vulnerability

6 documents6 sources
Severity
4.0MEDIUMNVD
EPSS
3.1%
top 13.26%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Oracle MysqlCanonical Ubuntu LinuxDebian Linux
Timeline
PublishedMay 10
Latest updateMay 1

Description

The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-dependent attackers to cause a denial of service (crash) via a crafted IF clause that results in a divide-by-zero error and a NULL pointer dereference.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 8.0 | Impact: 2.9

Affected Packages1 packages

▶NVDoracle/mysql5.1 — 5.1.17+1

Also affects: Debian Linux 3.1, 4.0, Ubuntu Linux 6.06, 6.10, 7.04

Patches

Patch: secunia.com ↗Patch: www.debian.org ↗Patch: secunia.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-hf23-jpgj-4fhg: The in_decimal::set function in item_cmpfunc↗2022-05-01
▶

💥Exploits & PoCs

1
Exploit-DB
MySQL 5.0.x - IF Query Handling Remote Denial of Service↗2013-12-04
▶

📋Vendor Advisories

2
Ubuntu
MySQL vulnerabilities↗2007-10-11
▶
Red Hat
mysql: DoS via statement with crafted IF clause↗2007-03-29
▶

💬Community

1
Bugzilla
CVE-2007-2583 mysql: DoS via statement with crafted IF clause↗2007-05-21
▶