CVE-2019-2529

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
Oracle Corporation	MySQL Server	5.6.42 and prior; 5.7.24 and prior; 8.0.13 and prior

References

http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/106619Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2327Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2484Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2511Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00000.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201908-24Third Party Advisory
https://security.netapp.com/advisory/ntap-20190118-0002/Third Party Advisory
https://usn.ubuntu.com/3867-1/Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/106619Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2327Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2484Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2511Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00000.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201908-24Third Party Advisory
https://security.netapp.com/advisory/ntap-20190118-0002/Third Party Advisory
https://usn.ubuntu.com/3867-1/Third Party Advisory

Timeline

Published: Jan 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-252905.3Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through CVE-2019-252917.5INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed thro CVE-2019-252927.8Alps HID Monitor Service 8.1.0.10 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitra CVE-2019-252937.8BlueStacks App Player 2.4.44.62.57 contains an unquoted service path vulnerability in the BstHdLogRotatorSvc service that allows local attac CVE-2019-252946.1html5_snmp 1.11 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through the 'Rema CVE-2019-252956.5The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles fun CVE-2019-252969.8The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the CVE-2019-252975.1Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vul CVE-2019-252989.1html5_snmp 1.11 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through Router_ID and Ro CVE-2019-252997.1RimbaLinux AhadPOS 1.11 contains a SQL injection vulnerability in the 'alamatCustomer' parameter that allows attackers to manipulate databas CVE-2019-25304.9Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.CVE-2019-253007.1thejshen Globitek CMS 1.4 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET p