Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 600180 (CVE-2016-1249) - <dev-perl/DBD-mysql-4.39.0: Out-of-bounds read when using server-side prepared statement support
Summary: <dev-perl/DBD-mysql-4.39.0: Out-of-bounds read when using server-side prepare...
Status: RESOLVED FIXED
Alias: CVE-2016-1249
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://seclists.org/oss-sec/2016/q4/433
Whiteboard: B3 [glsa cve]
Keywords:
Depends on: CVE-2016-1251
Blocks: CVE-2015-8949 CVE-2016-1246
  Show dependency tree
 
Reported: 2016-11-18 15:18 UTC by Thomas Deutschmann (RETIRED)
Modified: 2017-01-23 03:23 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-18 15:18:53 UTC 
A vulnerability was discovered in perl-DBD-MySQL that can lead to an out-of-bounds read when using server side prepared statements with an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.

This problem is only exposed when the user uses server-side prepared statement support, which is NOT default behavior and was turned off back for all drivers per MySQL AB decision in 2006 due to issues with server-side prepared statements in the server. The behavior of the driver is normally emulated.

Upstream patch:

https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-18 15:22:06 UTC 
A fixed version is already in tree: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=008eb96030a81ed1c5a0a37810097605b15815cf


@maintainer(s): In case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-28 01:48:14 UTC 
@ Arches,

please test and mark stable: =dev-perl/DBD-mysql-4.40.0
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-28 23:33:46 UTC 
Stabilization moved to bug 601144.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2017-01-23 03:23:28 UTC 
This issue was resolved and addressed in
 GLSA 201701-51 at https://security.gentoo.org/glsa/201701-51
by GLSA coordinator Aaron Bauman (b-man).