PT-2017-7947 · Mysql Server+3 · Dbd::Mysql+3

Pali · Published 2016-11-17 · Updated 2025-04-07 · CVE-2016-1249

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DBD::mysql versions prior to 4.039

Description The issue allows attackers to cause a denial of service, specifically an out-of-bounds read, when using server-side prepared statement support. This can be achieved through vectors involving an unaligned number of placeholders in the WHERE condition and output fields in the SELECT expression.

Recommendations For versions prior to 4.039, update to version 4.039 or later to resolve the issue. As a temporary workaround, consider avoiding the use of server-side prepared statement support until a patch is applied. Restrict the use of unaligned placeholders in WHERE conditions and output fields in SELECT expressions to minimize the risk of exploitation.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2016-2306

CVE-2016-1249

MGASA-2018-0031

OPENSUSE-SU-2024:10186-1

SUSE-SU-2017:0122-1

SUSE-SU-2017:0123-1

USN-5344-1

USN-7417-1

Affected Products

Alt Linux

Dbd::Mysql

Suse

Ubuntu

References · 38

• https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/NY3AHSF4ZPQQ5OGYZYNQOD7TBL7CAG4F · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10186-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0123-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1249 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/7BLHU5FAHMKZBZ4LAHIASWUJVK4O6JS6 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1249 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7417-1 · Vendor Advisory
• http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5344-1 · Vendor Advisory
• https://debian.org/security/2016/dsa-3684 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0031.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-1249 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:0122-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7417-1 · Vendor Advisory