| Name | CVE-2017-10788 |
| Description | The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-1079-1 |
| Debian Bugs | 866818 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libdbd-mysql-perl (PTS) | buster | 4.050-2 | fixed |
| bullseye | 4.050-3 | fixed |
| bookworm | 4.050-5 | fixed |
| sid, trixie | 4.052-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[stretch] - libdbd-mysql-perl <no-dsa> (Minor issue, can be fixed via point release)
[jessie] - libdbd-mysql-perl <no-dsa> (Minor issue, can be fixed via point release)
http://seclists.org/oss-sec/2017/q2/443
https://github.com/perl5-dbi/DBD-mysql/issues/120
https://github.com/perl5-dbi/DBD-mysql/pull/142