CVE-2014-9906

moderate-risk
Published 2016-08-19

Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.

Do I need to act?

~
3.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Dbd-Mysql

Affected Vendors

Debian Dbd-Mysql Project

References (14)

Release Notes http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.029/ChangeLog
Third Party Advisory http://www.debian.org/security/2016/dsa-3635
Mailing List http://www.openwall.com/lists/oss-security/2016/07/27/5
Mailing List http://www.openwall.com/lists/oss-security/2016/07/27/6
http://www.securityfocus.com/bid/92149
Issue Tracking https://github.com/perl5-dbi/DBD-mysql/commit/a56ae87a4c1c1fead7d09c3653905841cc...
Issue Tracking https://rt.cpan.org/Public/Bug/Display.html?id=97625
Release Notes http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.029/ChangeLog
Third Party Advisory http://www.debian.org/security/2016/dsa-3635
Mailing List http://www.openwall.com/lists/oss-security/2016/07/27/5
Mailing List http://www.openwall.com/lists/oss-security/2016/07/27/6
http://www.securityfocus.com/bid/92149
Issue Tracking https://github.com/perl5-dbi/DBD-mysql/commit/a56ae87a4c1c1fead7d09c3653905841cc...
Issue Tracking https://rt.cpan.org/Public/Bug/Display.html?id=97625
45
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 6/34 · Minimal
Exposure 7/34 · Low