Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3103-1 advisory.

    It was discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacker could     use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2014-9906)

    Hanno Bck discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacker     could use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-8949)

    Pali Rohr discovered that DBD::mysql incorrectly handled certain user supplied data. A remote attacker     could use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-1246)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two use-after-free vulnerabilities were discovered in DBD::mysql, a Perl DBI driver for the MySQL database server. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using DBD::mysql (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

Two use-after-free vulnerabilities were discovered in DBD::mysql, a Perl DBI driver for the MySQL database server. A remote attacker can take advantage of these flaws to cause a denial of service against an application using DBD::mysql (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

For Debian 7 'Wheezy', these problems have been fixed in version 4.021-1+deb7u1.

We recommend that you upgrade your libdbd-mysql-perl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
94069	Ubuntu 14.04 LTS : DBD::mysql vulnerabilities (USN-3103-1)	Nessus	Ubuntu Local Security Checks	critical
92643	Debian DSA-3635-1 : libdbd-mysql-perl - security update	Nessus	Debian Local Security Checks	critical
92639	Debian DLA-576-1 : libdbd-mysql-perl security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2014-9906

critical

Tenable Plugins

critical

critical

critical