Description
MySQL, when running on Windows, allows remote authenticated users with insert privileges on the mysql.func table to cause a denial of service (server hang) and possibly execute arbitrary code via (1) a request for a non-library file, which causes the Windows LoadLibraryEx function to block, or (2) a request for a function in a library that has the XXX_deinit or XXX_init functions defined but is not tailored for mySQL, such as jpeg1x32.dll and jpeg2x32.dll.
Remediation
References
Related Vulnerabilities
WordPress Plugin WordPress PDF Light Viewer Command Injection (1.4.11)
Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-9015)
WordPress Plugin CSV Importer Multiple Unspecified Vulnerabilities (0.3.7)
Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0119)