CVE-2015-8949

Published: Aug 19, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.

Affected (2)

Products: Dbd Mysql Project: Dbd Mysql · Debian: Debian Linux

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Dbd Mysql Project Dbd Mysql	Version 4.033
Debian Debian Linux	Version 8.0

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (18)

http://www.debian.org/security/2016/dsa-3635

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/07/25/13

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/07/27/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/92118

Source: cve@mitre.org

https://blog.fuzzing-project.org/50-Use-after-free-in-my_login-function-of-DBDmysql-Perl-module.html

Source: cve@mitre.org

Third Party Advisory

https://github.com/perl5-dbi/DBD-mysql/blob/4.033_01/Changes

Source: cve@mitre.org

Release Notes

https://github.com/perl5-dbi/DBD-mysql/commit/cf0aa7751f6ef8445e9310a64b14dc81460ca156

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/perl5-dbi/DBD-mysql/pull/45

Source: cve@mitre.org

Issue TrackingPatch

https://security.gentoo.org/glsa/201701-51

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3635