Multiple vulnerabilities have been found in DBD::mysql, the worst of which might allow an attacker to execute arbitrary code.

Announced

2017-01-23

Revised

2017-01-23 (revision 2)

Access

local, remote

Bugs

#589818 #596424 #600180 #601144

Advisory

https://security.gentoo.org/glsa/201701-51

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-perl/DBD-mysql	*	< 4.41.0	>= 4.41.0

Background

MySQL driver for the Perl5 Database Interface (DBI)

Description

Multiple vulnerabilities have been discovered in DBD::mysql. Please review the CVE identifiers referenced below for details.

Impact

An attacker could cause a Denial of Service condition, execute arbitrary code, or have other unspecified impacts.

Workaround

There is no known workaround at this time.

Resolution

All DBD::mysql users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-perl/DBD-mysql-4.41.0"

References

• CVE-2015-8949
• CVE-2016-1246
• CVE-2016-1249
• CVE-2016-1251