CVE-2014-9906

Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of...

9.8 CriticalFix available

CVE-2014-9906 is a critical vulnerability (CVSS 9.8) in Dbd-mysql Project Dbd-mysql, published July 29, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.08%, the 93rd percentile. Fixed in libdbd-mysql-perl 4.033-1.

Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.08%Up 3.4 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2014-9906
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-9906
Updated: 2026-11-02

EUVDEUVD-2014-9711 No score

Record: EUVD-2014-9711
Updated: 2026-11-03

GitHub AdvisoriesGHSA-676f-4267-c5c3 9.8

Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of...

Record: GHSA-676f-4267-c5c3
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 9.8

Record: CVE-2014-9906
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-9906 9.8

Record: DEBIAN-CVE-2014-9906
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-9906 9.8

Record: UBUNTU-CVE-2014-9906
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0300 No score

Updated perl-DBD-mysql packages fix security vulnerability

Two use-after-free vulnerabilities were discovered in DBD::mysql. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using DBD::mysql (application crash), or potentially to execute arbitrary code with the privileges of the user running the application(CVE-2014-9906, CVE-2015-8949).

Record: MGASA-2016-0300
Updated: 2026-11-02

OSVUSN-3103-1 No score

libdbd-mysql-perl vulnerabilities

It was discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacker could use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-9906)

Hanno Böck discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacker could use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8949)

Pali Rohár discovered that DBD::mysql incorrectly handled certain user supplied data. A remote attacker could use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-1246)

Record: USN-3103-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libdbd-mysql-perl` Debian:12	before 4.033-1	4.033-1
`libdbd-mysql-perl` Debian:13	before 4.033-1	4.033-1
`libdbd-mysql-perl` Debian:14	before 4.033-1	4.033-1
`libdbd-mysql-perl` Debian:7	before 4.021-1+deb7u1, plus listed versions 4.021-1	4.021-1+deb7u1
`libdbd-mysql-perl` Debian:8	before 4.028-2+deb8u1, plus listed versions 4.028-2	4.028-2+deb8u1
`perl-DBD-mysql` Mageia:5	before 4.28.0-3.1.mga5	4.28.0-3.1.mga5
`libdbd-mysql-perl` Ubuntu:14.04:LTS	before 4.025-1ubuntu0.1, plus listed versions 4.023-14.024-14.025-1	4.025-1ubuntu0.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less