Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 02 Dec 2012 15:53:16 +0530
From: Huzaifa Sidhpurwala <>
CC: Kurt Seifried <>,
        king cope <>,,,,,
        Mitre CVE assign department <>,
        Steven Christey <>,,, Ritwik Ghoshal <>,
Subject: Re: Re: [Full-disclosure] MySQL (Linux) Stack based
 buffer overrun PoC Zeroday

On 12/02/2012 11:30 AM, Kurt Seifried wrote:
> So normally for MySQL issues Oracle would assign the CVE #. However in
> this case we have a bit of a time constraint (it's a weekend and this
> is blowing up quickly)  and the impacts are potentially quite severe.
> So I've spoken with some other Red Hat SRT members and we feel it is
> best to get CVE #'s assigned for these issues quickly so we can refer
> to them properly.
> If Oracle security has already assigned CVE's for these please let us
> and the public know so we can use the correct numbers. Also if Oracle
> can let the public know which versions of MySQL are affected (e.g.
> 5.0.x, 5.1.x, 5.5.x, etc.) that would be very helpful to everyone I am
> sure.

So here are the CVEs which Kurt meant to assign, but somehow
that mail never reached the lists.

* CVE-2012-5611 MySQL (Linux) Stack based buffer overrun PoC Zeroday

* CVE-2012-5612 MySQL (Linux) Heap Based Overrun PoC Zeroday

* CVE-2012-5613 MySQL (Linux) Database Privilege Elevation Zeroday

* CVE-2012-5614 MySQL Denial of Service Zeroday PoC

* CVE-2012-5615 MySQL Remote Preauth User Enumeration Zeroday

Huzaifa Sidhpurwala / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ