VulnerabilityModified

CVE-2014-9906

Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.

CRITICAL 9.8EPSS 6.03%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (6.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 6.03% probability · 93th percentile
CISA KEV: Not listed
Weakness: CWE-416
Affected: debian/debian linux · dbd-mysql project/dbd-mysql
Source: security@debian.org

References

http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.029/ChangeLogRelease Notes
http://www.debian.org/security/2016/dsa-3635Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/07/27/5Mailing List, VDB Entry
http://www.openwall.com/lists/oss-security/2016/07/27/6Mailing List, VDB Entry
http://www.securityfocus.com/bid/92149
https://github.com/perl5-dbi/DBD-mysql/commit/a56ae87a4c1c1fead7d09c3653905841ccccf1ccIssue Tracking, Patch
https://rt.cpan.org/Public/Bug/Display.html?id=97625Issue Tracking
http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.029/ChangeLogRelease Notes
http://www.debian.org/security/2016/dsa-3635Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/07/27/5Mailing List, VDB Entry
http://www.openwall.com/lists/oss-security/2016/07/27/6Mailing List, VDB Entry
http://www.securityfocus.com/bid/92149
https://github.com/perl5-dbi/DBD-mysql/commit/a56ae87a4c1c1fead7d09c3653905841ccccf1ccIssue Tracking, Patch
https://rt.cpan.org/Public/Bug/Display.html?id=97625Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.