Description
MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mysql +4 | 5.0.45-7.el5 | RHSA-2008:0364 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- MySQL 5.0.x - Single Row SubSelect Remote Denial of Service EDB-29724 · dos · Mar 9, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2008:0364 Red Hat Security Advisory: mysql security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-36.html
- 25196 third-party-advisory
- 24609 third-party-advisory
- https://issues.rpath.com/browse/RPL-1127
- 25389 third-party-advisory
- USN-440-1 vendor-advisory
- GLSA-200705-11 vendor-advisory
- 2413 third-party-advisory
- 25946 third-party-advisory
- ADV-2007-0908 vdb-entry
- 20070309 SEC Consult SA-20070309-0 :: MySQL 5 Single Row Subselect Denial of Service mailing-list
- 24483 third-party-advisory
- 1017746 vdb-entry
- http://www.sec-consult.com/284.html
- MDKSA-2007:139 vendor-advisory
- 30351 third-party-advisory
- http://bugs.mysql.com/bug.php?id=24630
- oval:org.mitre.oval:def:9530 vdb-entry signature
- 22900 vdb-entry
- RHSA-2008:0364 vendor-advisory