10

CVE-2015-8949

Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dbd-mysql Project ≫ Dbd-mysql Version4.033
Debian ≫ Debian Linux Version8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.49% 0.902
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://www.debian.org/security/2016/dsa-3635
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/07/25/13
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2016/07/27/1
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/92118
https://blog.fuzzing-project.org/50-Use-after-free-in-my_login-function-of-DBDmysql-Perl-module.html
Third Party Advisory
https://github.com/perl5-dbi/DBD-mysql/blob/4.033_01/Changes
Release Notes
https://github.com/perl5-dbi/DBD-mysql/commit/cf0aa7751f6ef8445e9310a64b14dc81460ca156
Patch
Issue Tracking
https://github.com/perl5-dbi/DBD-mysql/pull/45
Patch
Issue Tracking
https://security.gentoo.org/glsa/201701-51