CVE-2007-1420 Null dereference in n/a
Local attackers can crash the MySQL database by triggering a NULL dereference via specific information_schema queries, requiring a software upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-1420?
CVE-2007-1420 is a low-severity vulnerability in Mysql Mysql, published on 12 Mar 2007. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function.
Which versions are affected by CVE-2007-1420?
It affects 2 products.
Products include Mysql Mysql, Oracle Mysql.
How do I fix CVE-2007-1420?
Upgrade to a fixed version.
Is CVE-2007-1420 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-1420 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Mysql Mysql
Sources
Also known as GHSA-gf4h-r5mj-gf9j.