CVEvulnerability

CVE-2009-0819

4.0 MEDIUM Published 2009-03-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-03-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:N/A:P

Description

sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion failure.

Affected configurations

• mysql mysql (<= 5.1.32-bzr) • mysql mysql 5.1.23 • mysql mysql 5.1.31 • mysql mysql 6.0.9 • mysql mysql 6.0.10-bzr • oracle mysql 5.1 • oracle mysql 5.1.1 • oracle mysql 5.1.2 • oracle mysql 5.1.3 • oracle mysql 5.1.10 • oracle mysql 5.1.11 • oracle mysql 5.1.12 • oracle mysql 5.1.13 • oracle mysql 5.1.14 • oracle mysql 5.1.15 • oracle mysql 5.1.16 • oracle mysql 5.1.17 • oracle mysql 5.1.18 • oracle mysql 5.1.19 • oracle mysql 5.1.20 • oracle mysql 5.1.21 • oracle mysql 5.1.22 • oracle mysql 5.1.23 • oracle mysql 5.1.24 • oracle mysql 5.1.25 • oracle mysql 5.1.26 • oracle mysql 5.1.27 • oracle mysql 5.1.28 • oracle mysql 5.1.29 • oracle mysql 5.1.30 • oracle mysql 5.1.31 • oracle mysql 6.0.0 • oracle mysql 6.0.1 • oracle mysql 6.0.2 • oracle mysql 6.0.3 • oracle mysql 6.0.4

References