CVE-2009-2446

MySQL <5.0.83 - DoS

Title source: llm

Description

Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED
by kingcope · cdoslinux
https://www.exploit-db.com/exploits/33077

References (18)

Scores

EPSS 0.0727
EPSS Percentile 91.7%

Details

CWE
CWE-134
Status published
Products (46)
mysql/mysql 4.1.0
mysql/mysql 4.1.2
mysql/mysql 4.1.3
mysql/mysql 4.1.8
mysql/mysql 4.1.10
mysql/mysql 4.1.12
mysql/mysql 4.1.13
mysql/mysql 4.1.14
mysql/mysql 4.1.15
mysql/mysql 4.1.23
... and 36 more
Published Jul 13, 2009
Tracked Since Feb 18, 2026