CVE-2015-4870Mysql Vulnerability
mysql-5.5 - packages as an option announcement
Published Dec 4, 2015 · Updated Apr 27, 2026 · Also known as UBUNTU-CVE-2015-4870
Key Facts
Routine patching- CVE-2015-4870 is a medium-severity vulnerability (CVSS 4.0 v2) affecting Mariadb, Mysql (Oracle), Ubuntu Linux (Canonical) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 30% probability of exploitation in the next 30 days.
- Fixed versions are available, including liblz4-1 1.8.0-3.5.2, libmariadb_plugins 3.1.22-2.35.1, libmariadb-devel 3.1.22-2.35.1.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Scores
CVSS v2
4.0
AV:N/AC:L/Au:S/C:N/I:N/A:P
EPSS (30-day exploit likelihood)
30%
Higher than 98.2% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
43/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
3
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://ubuntu.com/security/CVE-2015-4870
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2015-4870
- advisoryFEDORA-2016-e30164d0a2
- advisoryopenSUSE-SU-2015:2244
- advisoryopenSUSE-SU-2015:2246
- advisoryopenSUSE-SU-2016:0368
Description
Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.
Affected Products
339 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| MariadbMariadb | See advisory | 5.5.46 |
| MysqlOracle | See advisory | 5.5.45 |
| Ubuntu LinuxCanonical | 12.04, 14.04, 15.04, 15.10 | n/a |
| Debian LinuxDebian | 7.0, 8.0 | n/a |
| FedoraFedoraproject | 23 | n/a |
Patched Releases
liblz4-1
1.8.0-3.5.2
libmariadb_plugins
3.1.22-2.35.1
libmariadb-devel
3.1.22-2.35.1
libmariadb3
3.1.22-2.35.1
libmariadbd104-devel
10.4.30-150100.3.5.10, 10.4.30-8.5.46
libmariadbd19
10.4.30-150100.3.5.10, 10.4.30-8.5.46
libmysql55client_r18
5.5.46-0.14.1
libmysql55client_r18-32bit
5.5.46-0.14.1
libmysql55client_r18-x86
5.5.46-0.14.1
libmysql55client18
5.5.46-0.14.1
libmysql55client18-32bit
5.5.46-0.14.1
libmysql55client18-x86
5.5.46-0.14.1
libmysql56client_r18
5.6.27-8.1, 5.6.34-1.1
libmysql56client_r18-32bit
5.6.27-8.1, 5.6.34-1.1
libmysql56client18
5.6.27-8.1, 5.6.34-1.1
libmysql56client18-32bit
5.6.27-8.1, 5.6.34-1.1
libmysqlclient_r18
10.0.22-2.18.1, 10.0.22-20.3.1, 10.0.22-3.1, 10.0.22-3.8
libmysqlclient_r18-32bit
10.0.22-2.18.1, 10.0.22-20.3.1, 10.0.22-3.1, 10.0.22-3.8
libmysqlclient-devel
10.0.22-2.18.1, 10.0.22-20.3.1, 10.0.22-3.1, 10.0.22-3.8
libmysqlclient18
10.0.22-2.18.1, 10.0.22-20.3.1, 10.0.22-3.1, 10.0.22-3.8
libmysqlclient18-32bit
10.0.22-2.18.1, 10.0.22-20.3.1, 10.0.22-3.1, 10.0.22-3.8
libmysqlclient18-debuginfo
10.0.22-2.18.1
libmysqlclient18-debuginfo-32bit
10.0.22-2.18.1
libmysqld-devel
10.0.22-2.18.1, 10.0.22-20.3.1, 10.0.22-3.1, 10.0.22-3.8
libmysqld18
10.0.22-2.18.1, 10.0.22-20.3.1, 10.0.22-3.1, 10.0.22-3.8
Timeline
Publicly disclosed
Dec 4, 2015
Last updated
Apr 27, 2026
References
- advisoryubuntu.com · CVE-2015-4870
- advisorycve.org · CVERecord
- advisoryFEDORA-2016-e30164d0a2
- advisoryopenSUSE-SU-2015:2244
- advisoryopenSUSE-SU-2015:2246
FAQ
Common Questions.
Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.
Affected: Mariadb; Mysql (Oracle); Ubuntu Linux (Canonical) versions 12.04, 14.04, 15.04, 15.10, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including liblz4-1 1.8.0-3.5.2, libmariadb_plugins 3.1.22-2.35.1, libmariadb-devel 3.1.22-2.35.1.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2015-4870 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo