Read the docs
TI-2014-00001 Aliases CVE-2014-0001GHSA-7pq3-qq22-gpw3

Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows…

Priority MEDIUM 42CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string.

Why it matters now

EPSS 0.06405 93rd percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 63

CPEVersionsRoleVendor
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*up to 5.5.34VulnerableMariaDB
cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:5:*:server:*:*:*:*:*5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:a:oracle:mysql:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableOracle
  • cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* Versions up to 5.5.34 Vulnerable ·MariaDB
  • cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:* Versions 5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5:*:server:*:*:*:*:* Versions 5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:mysql:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Oracle
Show 53 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:mysql:5.5.1:*:*:*:*:*:*:*5.5.1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.2:*:*:*:*:*:*:*5.5.2VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.3:*:*:*:*:*:*:*5.5.3VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.4:*:*:*:*:*:*:*5.5.4VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.5:*:*:*:*:*:*:*5.5.5VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.6:*:*:*:*:*:*:*5.5.6VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.7:*:*:*:*:*:*:*5.5.7VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.9:*:*:*:*:*:*:*5.5.9VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.10:*:*:*:*:*:*:*5.5.10VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.11:*:*:*:*:*:*:*5.5.11VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.12:*:*:*:*:*:*:*5.5.12VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.13:*:*:*:*:*:*:*5.5.13VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.14:*:*:*:*:*:*:*5.5.14VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.15:*:*:*:*:*:*:*5.5.15VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.16:*:*:*:*:*:*:*5.5.16VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.17:*:*:*:*:*:*:*5.5.17VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.18:*:*:*:*:*:*:*5.5.18VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.19:*:*:*:*:*:*:*5.5.19VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.20:*:*:*:*:*:*:*5.5.20VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.21:*:*:*:*:*:*:*5.5.21VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.22:*:*:*:*:*:*:*5.5.22VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.23:*:*:*:*:*:*:*5.5.23VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.24:*:*:*:*:*:*:*5.5.24VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.25:*:*:*:*:*:*:*5.5.25VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.25:a:*:*:*:*:*:*5.5.25 aVulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.26:*:*:*:*:*:*:*5.5.26VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.27:*:*:*:*:*:*:*5.5.27VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.28:*:*:*:*:*:*:*5.5.28VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.29:*:*:*:*:*:*:*5.5.29VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.30:*:*:*:*:*:*:*5.5.30VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.31:*:*:*:*:*:*:*5.5.31VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.32:*:*:*:*:*:*:*5.5.32VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.33:*:*:*:*:*:*:*5.5.33VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.34:*:*:*:*:*:*:*5.5.34VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.35:*:*:*:*:*:*:*5.5.35VulnerableOracle
cpe:2.3:a:oracle:mysql:5.5.36:*:*:*:*:*:*:*5.5.36VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.0:*:*:*:*:*:*:*5.6.0VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.1:*:*:*:*:*:*:*5.6.1VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.2:*:*:*:*:*:*:*5.6.2VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.3:*:*:*:*:*:*:*5.6.3VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.4:*:*:*:*:*:*:*5.6.4VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.5:*:*:*:*:*:*:*5.6.5VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.6:*:*:*:*:*:*:*5.6.6VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.7:*:*:*:*:*:*:*5.6.7VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.8:*:*:*:*:*:*:*5.6.8VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.9:*:*:*:*:*:*:*5.6.9VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.10:*:*:*:*:*:*:*5.6.10VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.11:*:*:*:*:*:*:*5.6.11VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.12:*:*:*:*:*:*:*5.6.12VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.13:*:*:*:*:*:*:*5.6.13VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.14:*:*:*:*:*:*:*5.6.14VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.15:*:*:*:*:*:*:*5.6.15VulnerableOracle
cpe:2.3:a:oracle:mysql:5.6.16:*:*:*:*:*:*:*5.6.16VulnerableOracle
  • cpe:2.3:a:oracle:mysql:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.2:*:*:*:*:*:*:* Versions 5.5.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.3:*:*:*:*:*:*:* Versions 5.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.4:*:*:*:*:*:*:* Versions 5.5.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.5:*:*:*:*:*:*:* Versions 5.5.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.6:*:*:*:*:*:*:* Versions 5.5.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.13:*:*:*:*:*:*:* Versions 5.5.13 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.14:*:*:*:*:*:*:* Versions 5.5.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.15:*:*:*:*:*:*:* Versions 5.5.15 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.16:*:*:*:*:*:*:* Versions 5.5.16 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.17:*:*:*:*:*:*:* Versions 5.5.17 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.18:*:*:*:*:*:*:* Versions 5.5.18 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.19:*:*:*:*:*:*:* Versions 5.5.19 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.20:*:*:*:*:*:*:* Versions 5.5.20 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.21:*:*:*:*:*:*:* Versions 5.5.21 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.22:*:*:*:*:*:*:* Versions 5.5.22 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.23:*:*:*:*:*:*:* Versions 5.5.23 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.24:*:*:*:*:*:*:* Versions 5.5.24 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.25:*:*:*:*:*:*:* Versions 5.5.25 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.25:a:*:*:*:*:*:* Versions 5.5.25 a Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.26:*:*:*:*:*:*:* Versions 5.5.26 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.27:*:*:*:*:*:*:* Versions 5.5.27 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.28:*:*:*:*:*:*:* Versions 5.5.28 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.29:*:*:*:*:*:*:* Versions 5.5.29 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.30:*:*:*:*:*:*:* Versions 5.5.30 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.31:*:*:*:*:*:*:* Versions 5.5.31 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.32:*:*:*:*:*:*:* Versions 5.5.32 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.33:*:*:*:*:*:*:* Versions 5.5.33 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.34:*:*:*:*:*:*:* Versions 5.5.34 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.35:*:*:*:*:*:*:* Versions 5.5.35 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.5.36:*:*:*:*:*:*:* Versions 5.5.36 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.1:*:*:*:*:*:*:* Versions 5.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.2:*:*:*:*:*:*:* Versions 5.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.3:*:*:*:*:*:*:* Versions 5.6.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.4:*:*:*:*:*:*:* Versions 5.6.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.5:*:*:*:*:*:*:* Versions 5.6.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.6:*:*:*:*:*:*:* Versions 5.6.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.7:*:*:*:*:*:*:* Versions 5.6.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.8:*:*:*:*:*:*:* Versions 5.6.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.9:*:*:*:*:*:*:* Versions 5.6.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.10:*:*:*:*:*:*:* Versions 5.6.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.11:*:*:*:*:*:*:* Versions 5.6.11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.12:*:*:*:*:*:*:* Versions 5.6.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.13:*:*:*:*:*:*:* Versions 5.6.13 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.14:*:*:*:*:*:*:* Versions 5.6.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.15:*:*:*:*:*:*:* Versions 5.6.15 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:5.6.16:*:*:*:*:*:*:* Versions 5.6.16 Vulnerable ·Oracle

Remediation

Red Hat 4 advisories

  • RHSA-2014:0189 Released 2014-02-19 · Red Hat rating Moderate
    mariadb55-mariadb security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) mariadb55-mariadb-5.5.35-1.1.el6, mariadb55-mariadb-bench-5.5.35-1.1.el6, mariadb55-mariadb-devel-5.5.35-1.1.el6 +3
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) mariadb55-mariadb-5.5.35-1.1.el6, mariadb55-mariadb-bench-5.5.35-1.1.el6, mariadb55-mariadb-devel-5.5.35-1.1.el6 +3
  • RHSA-2014:0186 Released 2014-02-18 · Red Hat rating Moderate
    mysql55-mysql security update
    • Red Hat Enterprise Linux (v. 5 server) mysql55-mysql-5.5.36-2.el5, mysql55-mysql-5.5.36-2.el5.i386, mysql55-mysql-5.5.36-2.el5.ia64 +21
    • Red Hat Enterprise Linux Desktop (v. 5 client) mysql55-mysql-5.5.36-2.el5, mysql55-mysql-5.5.36-2.el5.i386, mysql55-mysql-bench-5.5.36-2.el5 +7
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) mysql55-mysql-5.5.36-2.el5, mysql55-mysql-devel-5.5.36-2.el5, mysql55-mysql-devel-5.5.36-2.el5.i386
  • RHSA-2014:0173 Released 2014-02-13 · Red Hat rating Moderate
    mysql55-mysql security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) mysql55-mysql-5.5.36-1.1.el6, mysql55-mysql-bench-5.5.36-1.1.el6, mysql55-mysql-devel-5.5.36-1.1.el6 +3
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) mysql55-mysql-5.5.36-1.1.el6, mysql55-mysql-bench-5.5.36-1.1.el6, mysql55-mysql-devel-5.5.36-1.1.el6 +3
Show 1 more Red Hat advisories
  • RHSA-2014:0164 Released 2014-02-12 · Red Hat rating Moderate
    mysql security and bug fix update
    • Red Hat Enterprise Linux Desktop (v. 6) mysql-5.1.73-3.el6_5, mysql-libs-5.1.73-3.el6_5, mysql-server-5.1.73-3.el6_5
    • Red Hat Enterprise Linux Desktop Optional (v. 6) mysql-5.1.73-3.el6_5, mysql-bench-5.1.73-3.el6_5, mysql-devel-5.1.73-3.el6_5 +3
    • Red Hat Enterprise Linux HPC Node (v. 6) mysql-5.1.73-3.el6_5, mysql-libs-5.1.73-3.el6_5
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) mysql-5.1.73-3.el6_5, mysql-bench-5.1.73-3.el6_5, mysql-devel-5.1.73-3.el6_5 +4
    • Red Hat Enterprise Linux Server (v. 6) mysql-5.1.73-3.el6_5, mysql-bench-5.1.73-3.el6_5, mysql-devel-5.1.73-3.el6_5 +5
    • Red Hat Enterprise Linux Server Optional (v. 6) mysql-5.1.73-3.el6_5, mysql-embedded-5.1.73-3.el6_5, mysql-embedded-5.1.73-3.el6_5.ppc +2
    • Red Hat Enterprise Linux Workstation (v. 6) mysql-5.1.73-3.el6_5, mysql-bench-5.1.73-3.el6_5, mysql-devel-5.1.73-3.el6_5 +3
    • Red Hat Enterprise Linux Workstation Optional (v. 6) mysql-5.1.73-3.el6_5, mysql-embedded-5.1.73-3.el6_5, mysql-embedded-devel-5.1.73-3.el6_5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2014:0186
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2014:0186
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2014:0164
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:0164
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2014:0186
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2014:0164
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:0164
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:0164
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:0164
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:0164
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:0164
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:0173, RHSA-2014:0189
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:0173, RHSA-2014:0189
Not affected: 2 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0001
  2. 2026-10-03 Alias added: GHSA-7pq3-qq22-gpw3

References

Patch 3

Advisory 5

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences