Description
The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-dependent attackers to cause a denial of service (crash) via a crafted IF clause that results in a divide-by-zero error and a NULL pointer dereference.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | mysql-dfsg-5.0 | 5.0.32-7etch3 | DSA-1413-1 |
| Debian 3.1 | mysql-dfsg | 4.0.24-10sarge3 | DSA-1413-1 |
| Debian 3.1 | mysql-dfsg-4.1 | 4.1.11a-4sarge8 | DSA-1413-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | mysql +4 | 5.0.45-7.el5 | RHSA-2008:0364 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- MySQL 5.0.x - IF Query Handling Remote Denial of Service EDB-30020 · dos · Dec 4, 2013 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2008:0364 Red Hat Security Advisory: mysql security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1413-1 mysql - multiple Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2007-1731 vdb-entry
- 27823 third-party-advisory
- 25196 third-party-advisory
- 25188 third-party-advisory
- https://issues.rpath.com/browse/RPL-1356
- 25389 third-party-advisory
- 2007-0017 vendor-advisory
- mysql-if-dos(34232) vdb-entry
- GLSA-200705-11 vendor-advisory
- http://bugs.mysql.com/bug.php?id=27513
- 30020 exploit
- 25946 third-party-advisory
- 23911 vdb-entry
- DSA-1413 vendor-advisory
- http://lists.mysql.com/commits/23685
- USN-528-1 vendor-advisory
- MDKSA-2007:139 vendor-advisory
- oval:org.mitre.oval:def:9930 vdb-entry signature
- 30351 third-party-advisory
- 27155 third-party-advisory
- 34734 vdb-entry
- 25255 third-party-advisory
- 28838 third-party-advisory
- SUSE-SR:2008:003 vendor-advisory
- RHSA-2008:0364 vendor-advisory
- http://packetstormsecurity.com/files/124295/MySQL-5.0.x-Denial-Of-Service.html