CVE-2010-3677

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-01-11 · updated 2026-06-16
Weakness: CWE-399

Description

Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.

Affected products

Mysql: through 5.1.48; through 5.0.91; 5.1.23, 5.1.31, 5.1.32, 5.1.34, 5.1.37, 5.0.0 (+20)
MySQL Server: 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.10, 5.1.11 (+82)

References

http://bugs.mysql.com/bug.php?id=54575
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
http://secunia.com/advisories/42875
http://secunia.com/advisories/42936
http://support.apple.com/kb/HT4723
http://www.debian.org/security/2011/dsa-2143
http://www.mandriva.com/security/advisories?name=MDVSA-2010:155
http://www.mandriva.com/security/advisories?name=MDVSA-2010:222
http://www.mandriva.com/security/advisories?name=MDVSA-2011:012

Get alerted when CVE-2010-3677 or the next vulnerability affects your stack