MariaDB: Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server

A vulnerability was discovered in the MariaDB database server's STGeomFromGeoJSON function. Any authenticated user with basic SELECT privileges could crash the entire server by passing a deeply nested GeoJSON GeometryCollection. The crash was caused by unbounded recursion in the GeoJSON parser,...

CVE-2016-1000225

Affected versions of "sequelize" are vulnerable to SQL Injection in Models that have fields with the "GEOMETRY" DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using "STGeomFromGeoJSON", and MySQL GeoJSON documents using...