Bug 919247 (CVE-2013-1861) - CVE-2013-1861 mysql: geometry query crashes mysqld (CPU July 2013)
Summary: CVE-2013-1861 mysql: geometry query crashes mysqld (CPU July 2013)
Alias: CVE-2013-1861
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 921836 986138 990796 1035870
Blocks: 919250 985658
TreeView+ depends on / blocked
Reported: 2013-03-07 22:25 UTC by Vincent Danen
Modified: 2023-05-11 22:15 UTC (History)
5 users (show)

Fixed In Version: mysql 5.6.12, mysql 5.5.32, mysql 5.1.70
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-01-21 06:19:37 UTC

Attachments (Terms of Use)

Description Vincent Danen 2013-03-07 22:25:59 UTC
Alyssa Milburn reported that when MySQL attempts to convert a binary string representation of a raw geometry object to a textual representation, the length checks in MySQL's spatial functions would overflow, resulting in a crash of mysqld (for instance, a query like "select astext(0x0100000000030000000100000000000010);" will cause the crash).

This has been reported to both upstream MariaDB [1] and Oracle [2].  A proposed patch is available [3].

[1] https://mariadb.atlassian.net/browse/MDEV-4252
[2] http://bugs.mysql.com/bug.php?id=68591
[3] http://lists.askmonty.org/pipermail/commits/2013-March/004371.html


Red Hat would like to thank Alyssa Milburn for reporting this issue.

Comment 1 Vincent Danen 2013-03-07 22:27:08 UTC
No CVE has been assigned; I presume that Oracle will likely end up doing that (hard to tell since their bug is private).

Comment 5 Huzaifa S. Sidhpurwala 2013-03-15 04:57:30 UTC
Created mysql tracking bugs for this issue

Affects: fedora-all [bug 921836]

Comment 6 Huzaifa S. Sidhpurwala 2013-03-15 06:17:59 UTC
This issue was assigned CVE-2013-1861 via:

Comment 8 Huzaifa S. Sidhpurwala 2013-03-15 10:21:48 UTC

This issue was addressed in the package mysql55-mysql as shipped with Red Hat Enterprise Linux 5 via RHEA-2013:1330. This issue was addressed in the package mysql as shipped with Red Hat Enterprise Linux 6 via RHBA-2013:1647.

Comment 9 Alyssa Milburn 2013-03-18 14:27:47 UTC
See also: http://lists.askmonty.org/pipermail/commits/2013-March/004447.html

Comment 11 Fedora Update System 2013-06-13 06:53:07 UTC
community-mysql-5.5.31-7.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Vincent Danen 2013-07-18 03:24:50 UTC
This issue is noted as being corrected in the Oracle July 2013 CPU:


It is reported to be fixed in 5.6.12, 5.5.32, and 5.1.70.

Note You need to log in before you can comment on or make changes to this bug.