CVE-2008-3963

MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.

Link	Resource
https://bugs.gentoo.org/237166
http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html
http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html
http://www.openwall.com/lists/oss-security/2008/09/09/7
http://bugs.mysql.com/bug.php?id=35658
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html
http://www.openwall.com/lists/oss-security/2008/09/09/4
http://www.securitytracker.com/id?1020858
http://secunia.com/advisories/31769	Vendor Advisory
http://secunia.com/advisories/32759	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
http://www.mandriva.com/security/advisories?name=MDVSA-2009:094
http://www.debian.org/security/2009/dsa-1783	Patch
http://secunia.com/advisories/34907	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2009-1067.html
http://www.vupen.com/english/advisories/2008/2554	Vendor Advisory
http://www.ubuntu.com/usn/USN-671-1
http://secunia.com/advisories/32769
http://secunia.com/advisories/36566
http://www.redhat.com/support/errata/RHSA-2009-1289.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/45042
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10521
http://www.ubuntu.com/usn/USN-1397-1

Configuration 1

cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.10:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.54:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.1.23:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.15:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.17:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.5.0.21:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.44:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.56:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.60:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.30:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.36:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.0.16:*:*:*:*:*:*:* cpe:2.3:a:mysql:mysql:5.1.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:6.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:6.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:6.0.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:6.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.50:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.51:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.0:alpha:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.23:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.25:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.26:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.30:sp1:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.32:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.33:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.38:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.42:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.45:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.0.52:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.7:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.8:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.9:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.11:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.12:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.13:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.14:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.15:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.16:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.17:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.18:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.19:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.20:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.21:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql:5.1.22:*:*:*:*:*:*:*

---

Published : 2008-09-11 01:13

Updated : 2019-12-17 08:26

---

NVD link : CVE-2008-3963

Mitre link : CVE-2008-3963

No products.

CWE-134

Use of Externally-Controlled Format String