CVE-2012-4414

Description

Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP1	mariadb104	10.4.30-150100.3.5.10	SUSE-RU-2023:3956-1
SLES 15 SP1	python-mysqlclient	1.4.6-150100.3.3.7	SUSE-RU-2023:3956-1
SLES 12 SP5	lz4	1.8.0-3.5.2	SUSE-RU-2023:4991-1
SLES 12 SP5	mariadb-connector-c	3.1.22-2.35.1	SUSE-RU-2023:4991-1
SLES 12 SP5	mariadb104	10.4.30-8.5.46	SUSE-RU-2023:4991-1
SLES 12 SP5	python-mysqlclient	1.3.14-8.9.2	SUSE-RU-2023:4991-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP1	mariadb104	10.4.30-150100.3.5.10	SUSE-RU-2023:3956-1
SLES for SAP 15 SP1	python-mysqlclient	1.4.6-150100.3.3.7	SUSE-RU-2023:3956-1
SLES for SAP 12 SP5	lz4	1.8.0-3.5.2	SUSE-RU-2023:4991-1
SLES for SAP 12 SP5	mariadb-connector-c	3.1.22-2.35.1	SUSE-RU-2023:4991-1
SLES for SAP 12 SP5	mariadb104	10.4.30-8.5.46	SUSE-RU-2023:4991-1
SLES for SAP 12 SP5	python-mysqlclient	1.3.14-8.9.2	SUSE-RU-2023:4991-1
SLE HPC 15 SP1	mariadb104	10.4.30-150100.3.5.10	SUSE-RU-2023:3956-1
SLE HPC 15 SP1	python-mysqlclient	1.4.6-150100.3.3.7	SUSE-RU-2023:3956-1

openSUSE