DBD-mysql 4.032_01
Security Advisories
CVE-2017-10788
The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples.
- https://github.com/perl5-dbi/DBD-mysql/issues/120
- http://www.securityfocus.com/bid/99374
- http://seclists.org/oss-sec/2017/q2/443
Fixed version: >=4.044
Reported: 2017-04-13
CVE-2017-10789
The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
Fixed version: >=4.044
Reported: 2017-03-23
CVE-2016-1249
Out-of-bounds read.
Fixed version: <2.9003,>=4.039
Reported: 2016-11-16
CVE-2016-1246
Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.
- https://github.com/perl5-dbi/DBD-mysql/commit/7c164a0c86cec6ee95df1d141e67b0e85dfdefd2
- http://blogs.perl.org/users/mike_b/2016/10/security-release---buffer-overflow-in-dbdmysql-perl-library.html
Fixed version: >=4.037
Reported: 2016-10-02
CVE-2015-8949
Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
Fixed version: >=4.034
Reported: 2016-08-19
CVE-2016-1251
There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1.
Fixed version: >=4.041
Reported: 2015-12-27
Kwalitee Issues
No Core Issues.
- meta_yml_has_provides
-
Add all modules contained in this distribution to the META.yml field 'provides'. Module::Build or Dist::Zilla::Plugin::MetaProvides do this automatically for you.