{"id":"CVE-2016-1249","aliases":["DEBIAN-CVE-2016-1249","EUVD-2016-2348","GHSA-v93g-vffx-whwx","MGASA-2018-0031","SUSE-SU-2017:0122-1","SUSE-SU-2017:0123-1","UBUNTU-CVE-2016-1249","USN-5344-1","USN-7417-1","openSUSE-SU-2024:10186-1"],"status":"published","title":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support,...","description":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02428,"percentile":0.84331,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2017-01-13T10:07:12Z","modified":"2026-10-20T13:12:13Z","fixes":[{"ecosystem":"Debian:12","package":"libdbd-mysql-perl","fixed_in":["4.039-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libdbd-mysql-perl","fixed_in":["4.039-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdbd-mysql-perl","fixed_in":["4.039-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbd-mysql-perl","fixed_in":["4.025-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbd-mysql-perl","fixed_in":["4.033-1ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.039-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.039-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.039-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.43.0-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.43.0-1.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.008-9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.008-9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.008-9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.021-11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.021-11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.021-11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.021-11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.021-11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.025-1ubuntu0.1+esm1"}]}],"versions":["4.023-1","4.024-1","4.025-1","4.025-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.033-1ubuntu0.1+esm1"}]}],"versions":["4.028-2","4.033-1","4.033-1build1","4.033-1build2","4.033-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.033-1ubuntu0.1+esm1"}]}],"versions":["4.028-2","4.033-1","4.033-1build1","4.033-1build2","4.033-1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbd-mysql-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.025-1ubuntu0.1+esm1"}]}],"versions":["4.023-1","4.024-1","4.025-1","4.025-1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-DBD-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.041-2.1"}]}],"bundled":3}],"products":[{"vendor":"dbd-mysql_project","product":"dbd-mysql"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/11/16/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Mitigation","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/94350","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201701-51","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1249"},{"url":"https://github.com/advisories/GHSA-v93g-vffx-whwx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1249","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0031.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19522","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3684","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NY3AHSF4ZPQQ5OGYZYNQOD7TBL7CAG4F/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7BLHU5FAHMKZBZ4LAHIASWUJVK4O6JS6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3CWISRFDOB7YRPBNDD3BNIQHSRYBDD6S/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TAWTNCSYWNBJHJR4AYQAAW65JVWDWMEW/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170122-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1002626","tags":["report"]},{"url":"https://bugzilla.suse.com/1010457","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1249","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170123-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012546","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1251","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-1249","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5344-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1249","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7417-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10789","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-1249","description":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.","status":"published","published":"2017-02-16T18:00:00Z","modified":"2024-08-05T22:48:13.661Z","updated_at":"2026-11-02T14:33:35.841056Z"}],"euvd":[{"id":"EUVD-2016-2348","description":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.","status":"published","published":"2017-02-16T18:00:00Z","modified":"2024-08-05T22:48:13Z","updated_at":"2026-11-03T02:22:57.974183Z"}],"ghsa":[{"id":"GHSA-v93g-vffx-whwx","title":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support,...","description":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.","status":"published","published":"2022-05-13T01:07:08Z","modified":"2023-02-01T05:03:06Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:50:01.019018Z"}],"nvd":[{"id":"CVE-2016-1249","description":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.","status":"published","published":"2017-02-17T02:59:10.78Z","modified":"2026-06-17T00:41:33.283Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-1249","description":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.","status":"published","published":"2017-02-17T02:59:10.78Z","modified":"2026-10-20T13:12:13.114583946Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1249","description":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.","status":"published","published":"2017-02-17T02:59:10.78Z","modified":"2026-09-22T07:01:14.08110803Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1249","description":"The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.","status":"published","published":"2017-02-17T02:59:00Z","modified":"2026-02-04T04:23:28.86783Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"MGASA-2018-0031","title":"Updated perl-DBD-mysql packages fix security vulnerability","description":"Pali Rohar discovered that DBD::mysql constructed an error message in a\nfixed-length buffer, leading to a crash (_FORTIFY_SOURCE failure) and,\npotentially, to denial of service (CVE-2016-1246).\n\nA vulnerability was discovered in perl-DBD-MySQL that can lead to an\nout-of-bounds read when using server side prepared statements with an\nunaligned number of placeholders in WHERE condition and output fields in\nSELECT expression (CVE-2016-1249).\n\nThere is a vulnerability of type use-after-free affecting DBD::mysql\nbefore 4.041 when used with mysql_server_prepare=1 (CVE-2016-1251).\n\nThe DBD::mysql module through 4.043 for Perl allows remote attackers to\ncause a denial of service (use-after-free and application crash) or\npossibly have unspecified other impact by triggering (1) certain error\nresponses from a MySQL server or (2) a loss of a network connection to a\nMySQL server. The use-after-free defect was introduced by relying on\nincorrect Oracle mysql_stmt_close documentation and code examples\n(CVE-2017-10788).\n\nThe DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting\nto mean that SSL is optional (even though this setting's documentation has\na \"your communication with the server will be encrypted\" statement), which\nallows man-in-the-middle attackers to spoof servers via a\ncleartext-downgrade attack (CVE-2017-10789).\n\nNote that the CVE-2016-1246, CVE-2017-1249, and CVE-2016-1251 issues only\naffected Mageia 5.\n\nAlso note that server-side prepared statements are disabled by default.\n","status":"published","published":"2018-01-03T14:22:14Z","modified":"2026-04-16T06:23:12.758730025Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10186-1","title":"perl-DBD-mysql-4.041-2.1 on GA media","description":"These are all security issues fixed in the perl-DBD-mysql-4.041-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:28.680214Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2017:0122-1","title":"Security update for perl-DBD-mysql","description":"\nThis update for perl-DBD-mysql fixes the following issues:\n\n- CVE-2016-1246: Buffer overflow allowed context-dependent attackers to cause a denial of service (crash) via vectors related to an error message (bsc#1002626).\n- CVE-2016-1249: Out-of-bounds read when using server-side prepared statement support (bsc#1010457).\n","status":"published","published":"2017-01-13T10:07:12Z","modified":"2026-02-04T04:20:31.255574Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0123-1","title":"Security update for perl-DBD-mysql","description":"\nThis update for perl-DBD-mysql fixes the following issues:\n\n- CVE-2016-1251: A use-after-free when used with mysql_server_prepare=1 (bsc#1012546).\n- CVE-2016-1246: Buffer overflow allowed context-dependent attackers to cause a denial of service (crash) via vectors related to an error message (bsc#1002626).\n- CVE-2016-1249: Out-of-bounds read when using server-side prepared statement support (bsc#1010457).\n","status":"published","published":"2017-01-13T10:07:43Z","modified":"2026-02-04T02:48:28.287236Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-5344-1","title":"libdbd-mysql-perl vulnerabilities","description":"It was discovered that the DBD::mysql module, when configured with server-side\nprepared statement support, was susceptible to operations that would result in\nimproper memory access. An attacker could possibly use this issue to cause\nDBD::mysql to crash, resulting in a denial of service.\n(CVE-2016-1249, CVE-2016-1251)\n\nIt was discovered that the DBD::mysql module was susceptible to an operation\nthat would result in improper memory access, introduced through incorrect\ndocumentation and code examples. An attacker could possibly use this issue to\ncause DBD::mysql to crash or potentially cause other, unspecified, impact.\n(CVE-2017-10788)\n\nIt was discovered that the DBD::mysql module processed SSL/TLS settings in a\nway that did not fully correlate with the respective documentation for each\nsetting. An attacker could possibly use this to perform a cleartext-downgrade\nattack. (CVE-2017-10789)\n","status":"published","published":"2022-04-01T20:31:18Z","modified":"2026-06-25T13:31:06.029171942Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-7417-1","title":"libdbd-mysql-perl vulnerabilities","description":"It was discovered that libdbd-mysql-perl did not correctly handle certain\nSQL queries. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2016-1249)\n\nIt was discovered that libdbd-mysql-perl did not correctly handle certain\nmemory operations, which could lead to a use-after-free vulnerability. A\nremote attacker could possibly use this issue to cause a denial of service\nor execute arbitrary code. (CVE-2016-1251, CVE-2017-10788)\n\nIt was discovered that libdbd-mysql-perl did not properly enforce SSL\nconnections depending on the mysql_ssl setting. A machine-in-the-middle\nattacker could possibly use this issue to spoof servers. (CVE-2017-10789)\n","status":"published","published":"2025-04-07T01:37:37Z","modified":"2026-02-10T04:47:48Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}