[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2016-1251 - use after free in DBD::mysql when using prepared statements - medium
From:       Michiel Beijen <michiel.beijen () gmail ! com>
Date:       2016-11-28 21:49:58
Message-ID: CABD0r11CUY3FvC0S+At_ApCKoEAGC2CLWQ_N0c1dzQ4VRgndQA () mail ! gmail ! com
[Download RAW message or body]

DBD::mysql is the perl DBI driver for MySQL and the primary way Perl
applications and scripts access MySQL and MariaDB databases. The
source repository is at https://github.com/perl5-dbi/DBD-mysql.

A vulnerability was discovered that can lead to a use after free when
using prepared statements. This vulnerability is present in all
releases at least back to versions 3.0 of the driver, which were
released in 2005.

The CVE identifier for this vulnerability is CVE-2016-1251.

Version 4.041, including the fix for this vulnerability, is available
on CPAN at https://metacpan.org/pod/DBD::mysql

The fix itself is available at
https://github.com/perl5-dbi/DBD-mysql/commit/3619c170461a3107a258d1fd2d00e=
d4832adb1b1

Users of DBD::mysql using prepared statements are advised to patch
their installations as soon as possible. Distributors of DBD::mysql
are requested to make this fix available to their end users.

Many thanks to Pali Roh=C3=A1r for discovering and fixing the vulnerability=
.

--
The DBD::mysql maintainers,

Patrick Galbraith
Michiel Beijen
[prev in list] [next in list] [prev in thread] [next in thread]