CVE-2015-8949

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2016/dsa-3635Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/07/25/13Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/07/27/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92118
https://blog.fuzzing-project.org/50-Use-after-free-in-my_login-function-of-DBDmysql-Perl-module.htmlThird Party Advisory
https://github.com/perl5-dbi/DBD-mysql/blob/4.033_01/ChangesRelease Notes
https://github.com/perl5-dbi/DBD-mysql/commit/cf0aa7751f6ef8445e9310a64b14dc81460ca156Issue Tracking, Patch
https://github.com/perl5-dbi/DBD-mysql/pull/45Issue Tracking, Patch
https://security.gentoo.org/glsa/201701-51
http://www.debian.org/security/2016/dsa-3635Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/07/25/13Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/07/27/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92118
https://blog.fuzzing-project.org/50-Use-after-free-in-my_login-function-of-DBDmysql-Perl-module.htmlThird Party Advisory
https://github.com/perl5-dbi/DBD-mysql/blob/4.033_01/ChangesRelease Notes
https://github.com/perl5-dbi/DBD-mysql/commit/cf0aa7751f6ef8445e9310a64b14dc81460ca156Issue Tracking, Patch
https://github.com/perl5-dbi/DBD-mysql/pull/45Issue Tracking, Patch
https://security.gentoo.org/glsa/201701-51

Timeline

Published: Aug 19, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-89505.5arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initializ CVE-2015-89517.8Multiple use-after-free vulnerabilities in sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm sound driver in Android before 2016-10-05 CVE-2015-89525.5The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching, which all CVE-2015-89535.5fs/overlayfs/copy_up.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of s CVE-2015-89549.8The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attacker CVE-2015-89557.3arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of CVE-2015-89566.1The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive informati CVE-2015-89576.5Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SU CVE-2015-89586.5coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application cra CVE-2015-89596.5coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS fil CVE-2015-89608.1The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateT CVE-2015-89617.8The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a de