CVE-2006-3469

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 31.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-07-21 · updated 2026-06-16
Weakness: CWE-134

Description

Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later used in a formatted print call to display the error message.

Affected products

Mysql: 4.1.8, 4.1.12, 4.1.13, 4.1.14, 4.1.15, 5.0.5.0.21 (+4)
MySQL Server: 4.1.6, 4.1.7, 4.1.9, 4.1.11, 4.1.16, 4.1.18 (+9)

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=375694
http://bugs.mysql.com/bug.php?id=20729
http://dev.mysql.com/doc/refman/4.1/en/news-4-1-21.html
http://docs.info.apple.com/article.html?artnum=305214
http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html
http://secunia.com/advisories/21147
http://secunia.com/advisories/21366
http://secunia.com/advisories/24479
http://secunia.com/advisories/31226
http://security.gentoo.org/glsa/glsa-200608-09.xml
http://www.debian.org/security/2006/dsa-1112
http://www.redhat.com/support/errata/RHSA-2008-0768.html

Get alerted when CVE-2006-3469 or the next vulnerability affects your stack