CVE-2012-4414

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-01-22 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.

Affected products

MariaDB: 5.1.41, 5.1.42, 5.1.44, 5.1.47, 5.1.49, 5.1.50 (+33)
MySQL Server: through 5.5.28; 5.1.51, 5.1.52, 5.1.52-sp1, 5.1.53, 5.1.54, 5.1.55 (+31)

References

http://bugs.mysql.com/bug.php?id=66550
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00013.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00020.html
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.mysqlperformanceblog.com/2013/01/13/cve-2012-4414-in-mysql-5-5-29-and-percona-server-5-5-29/
http://www.openwall.com/lists/oss-security/2012/09/11/4
http://www.securityfocus.com/bid/55498
https://bugzilla.redhat.com/show_bug.cgi?id=852144
https://mariadb.atlassian.net/browse/MDEV-382

Get alerted when CVE-2012-4414 or the next vulnerability affects your stack