CVE-2016-1249 The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned nu...
MediumCVSS 5.9
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libdbd-mysql-perl(Debian:12) | < 4.039-1 | 4.039-1 |
| debian/libdbd-mysql-perl(Debian:13) | < 4.039-1 | 4.039-1 |
| debian/libdbd-mysql-perl(Debian:14) | < 4.039-1 | 4.039-1 |
| dbd-mysql project dbd-mysql | <= 4.038_01 | No fix listed |
References
- Debian Security Tracker CVE-2016-1249 vendor-advisory
- cpansearch.perl.org release-notes vendor-advisory
- [oss-security] 20161115 CVE-2016-1249: Out-of-bounds read by DBD::mysql >= version 2.9003 mailing-list mitigation patch third-party-advisory
- 94350 third-party-advisory vdb-entry
- github.com patch third-party-advisory
- GLSA-201701-51 vendor-advisory
- bugs.debian.org issue-tracking