A vulnerability was discovered in perl-DBD-MySQL that can lead to an out-of-bounds read when using server side prepared statements with an unaligned number of placeholders in WHERE condition and output fields in SELECT expression. This problem is only exposed when the user uses server-side prepared statement support, which is NOT default behavior and was turned off back for all drivers per MySQL AB decision in 2006 due to issues with server-side prepared statements in the server. The behavior of the driver is normally emulated. Upstream patch: https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe
A fixed version is already in tree: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=008eb96030a81ed1c5a0a37810097605b15815cf @maintainer(s): In case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
@ Arches, please test and mark stable: =dev-perl/DBD-mysql-4.40.0
Stabilization moved to bug 601144.
This issue was resolved and addressed in GLSA 201701-51 at https://security.gentoo.org/glsa/201701-51 by GLSA coordinator Aaron Bauman (b-man).