CVE-2009-0819

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-03-05 · updated 2026-06-16

Description

sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion failure.

Affected products

Mysql: through 5.1.32-bzr; 5.1.23, 5.1.31, 6.0.9, 6.0.10-bzr
MySQL Server: 5.1, 5.1.1, 5.1.2, 5.1.3, 5.1.10, 5.1.11 (+25)

References

http://bugs.mysql.com/bug.php?id=42495
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-32.html
http://dev.mysql.com/doc/refman/6.0/en/news-6-0-10.html
http://secunia.com/advisories/34115
http://www.securityfocus.com/bid/33972
http://www.securitytracker.com/id?1021786
http://www.vupen.com/english/advisories/2009/0594
https://exchange.xforce.ibmcloud.com/vulnerabilities/49050
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7544
http://bugs.mysql.com/bug.php?id=42495
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-32.html
http://dev.mysql.com/doc/refman/6.0/en/news-6-0-10.html

Get alerted when CVE-2009-0819 or the next vulnerability affects your stack