CVE-2014-9906

Published: Aug 19, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.

Affected (2)

Products: Debian: Debian Linux · Dbd Mysql Project: Dbd Mysql

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Dbd Mysql Project Dbd Mysql	Up to 4.028

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (14)

http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.029/ChangeLog

Source: security@debian.org

Release Notes

http://www.debian.org/security/2016/dsa-3635

Source: security@debian.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/07/27/5

Source: security@debian.org

Mailing ListVDB Entry

http://www.openwall.com/lists/oss-security/2016/07/27/6

Source: security@debian.org

Mailing ListVDB Entry

http://www.securityfocus.com/bid/92149

Source: security@debian.org

https://github.com/perl5-dbi/DBD-mysql/commit/a56ae87a4c1c1fead7d09c3653905841ccccf1cc

Source: security@debian.org

Issue TrackingPatch

https://rt.cpan.org/Public/Bug/Display.html?id=97625

Source: security@debian.org

Issue Tracking

http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.029/ChangeLog