perl5-dbi/DBD-mysql

perl5-dbi/DBD-mysql

Releases63

Frequency3 months 5 days

Last Release5 months ago

Stars67

MySQL driver for the Perl5 Database Interface (DBI)

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2017-10788NVD↗	<= 4.043	Jul 1, 2017Saturday, 1 July 2017, 18:29	—	7.5 HIGH
The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples.
CVE-2017-10789NVD↗	<= 4.043	Jul 1, 2017Saturday, 1 July 2017, 18:29	—	4.3 MEDIUM
The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
CVE-2016-1249NVD↗	<= 4.038_01	Feb 17, 2017Friday, 17 February 2017, 02:59	—	4.3 MEDIUM
The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.
CVE-2016-1251NVD↗	= 4.011, = 4.030_01, = 4.029, = 3.0002_2, = 4.017, = 3.0002_4, = 4.024, = 3.0004_1, = 4.035_03, = 4.039, = 4.038_01, = 4.035, = 4.00, = 3.0002_5, = 4.033_02, = 4.030_02, = 4.014, = 4.006, = 3.0005_1, = 4.032_03, = 4.027, = 4.019, = 4.003, = 4.038, = 4.034, = 4.032_01, = 3.0008_1, = 4.035_01, = 4.032_02, = 4.026, = 4.018, = 4.010, = 4.009, = 4.001, = 3.0003_1, = 3.0001_1, = 3.0000_0, = 4.037, = 4.036, = 4.033_01, = 4.022, = 4.021, = 4.013, = 4.005, = 4.004, = 3.0007_2, = 3.0002_1, = 4.035_02, = 4.033, = 4.028, = 4.012, = 3.0005, = 3.0001_3, = 3.0001_2, = 4.037_01, = 4.033_03, = 4.031, = 4.023, = 4.016, = 4.015, = 4.008, = 4.007, = 4.040, = 4.032, = 4.025, = 4.020, = 4.002, = 3.0009_1, = 3.0002_3	Nov 29, 2016Tuesday, 29 November 2016, 20:59	—	6.8 MEDIUM
There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1.
CVE-2016-1246NVD↗	<= 4.036	Oct 5, 2016Wednesday, 5 October 2016, 16:59	—	5 MEDIUM
Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.
CVE-2015-8949NVD↗	= 4.033	Aug 19, 2016Friday, 19 August 2016, 21:59	—	10 HIGH
Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
CVE-2014-9906NVD↗	<= 4.028	Aug 19, 2016Friday, 19 August 2016, 21:59	—	10 HIGH
Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.