CVE-2012-5615
CVE-2012-5615
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.
EPSS 14.8% · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
mysql-5.5 Ubuntu:14.04:LTS
- Versions
- 5.5.32-0ubuntu7
- 5.5.34-0ubuntu1
- 5.5.34-0ubuntu2
- 5.5.35-0ubuntu1
- 5.5.35+dfsg-1ubuntu1
- 5.5.37-0ubuntu0.14.04.1
- 5.5.38-0ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 5.5.40-0ubuntu0.14.04.1
Update to 5.5.40-0ubuntu0.14.04.1
mysql-5.6 Ubuntu:14.04:LTS
- Versions
- 5.6.15-0ubuntu1
- 5.6.15-1~exp2
- 5.6.16-1~exp1
- 5.6.17-0ubuntu0.14.04.1
- 5.6.19-0ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 5.6.27-0ubuntu0.14.04.1
Update to 5.6.27-0ubuntu0.14.04.1
Original sources
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
- http://secunia.com/advisories/53372
- http://www.openwall.com/lists/oss-security/2012/12/02/3
- http://seclists.org/fulldisclosure/2012/Dec/9
- http://security.gentoo.org/glsa/glsa-201308-06.xml
- http://www.openwall.com/lists/oss-security/2012/12/02/4
- https://mariadb.atlassian.net/browse/MDEV-3909
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00000.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- https://nvd.nist.gov/vuln/detail/CVE-2012-5615