Vulnerability-Lookup

ubuntu-cve-2017-10788

Vulnerability from osv_ubuntu

Published

2017-07-01 18:29

Modified

2025-09-08 16:44

Summary

Details

The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples.

Severity

9.8 (Critical)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2017-10788	REPORT
	http://seclists.org/oss-sec/2017/q2/443	REPORT
	https://ubuntu.com/security/notices/USN-5344-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-10788	REPORT
	https://ubuntu.com/security/notices/USN-7417-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libdbd-mysql-perl",
            "binary_version": "4.025-1ubuntu0.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "libdbd-mysql-perl",
        "purl": "pkg:deb/ubuntu/libdbd-mysql-perl@4.025-1ubuntu0.1+esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.025-1ubuntu0.1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.023-1",
        "4.024-1",
        "4.025-1",
        "4.025-1ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libdbd-mysql-perl",
            "binary_version": "4.033-1ubuntu0.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "libdbd-mysql-perl",
        "purl": "pkg:deb/ubuntu/libdbd-mysql-perl@4.033-1ubuntu0.1+esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.033-1ubuntu0.1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.028-2",
        "4.033-1",
        "4.033-1build1",
        "4.033-1build2",
        "4.033-1ubuntu0.1"
      ]
    }
  ],
  "aliases": [],
  "details": "The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples.",
  "id": "UBUNTU-CVE-2017-10788",
  "modified": "2025-09-08T16:44:18Z",
  "published": "2017-07-01T18:29:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-10788"
    },
    {
      "type": "REPORT",
      "url": "http://seclists.org/oss-sec/2017/q2/443"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5344-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-10788"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7417-1"
    }
  ],
  "related": [
    "USN-5344-1",
    "USN-7417-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-10788"
  ]
}

CVE-2017-10788 (GCVE-0-2017-10788)

Vulnerability from cvelistv5 – Published: 2017-07-01 18:00 – Updated: 2024-08-05 17:50

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre

References

3 references

URL	Tags
http://seclists.org/oss-sec/2017/q2/443	x_refsource_MISC
https://github.com/perl5-dbi/DBD-mysql/issues/120	x_refsource_MISC
http://www.securityfocus.com/bid/99374	vdb-entryx_refsource_BID

Date Public

2017-07-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:50:11.845Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2017/q2/443"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/perl5-dbi/DBD-mysql/issues/120"
          },
          {
            "name": "99374",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99374"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-07-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-04T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://seclists.org/oss-sec/2017/q2/443"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/perl5-dbi/DBD-mysql/issues/120"
        },
        {
          "name": "99374",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99374"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-10788",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://seclists.org/oss-sec/2017/q2/443",
              "refsource": "MISC",
              "url": "http://seclists.org/oss-sec/2017/q2/443"
            },
            {
              "name": "https://github.com/perl5-dbi/DBD-mysql/issues/120",
              "refsource": "MISC",
              "url": "https://github.com/perl5-dbi/DBD-mysql/issues/120"
            },
            {
              "name": "99374",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99374"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-10788",
    "datePublished": "2017-07-01T18:00:00.000Z",
    "dateReserved": "2017-07-01T00:00:00.000Z",
    "dateUpdated": "2024-08-05T17:50:11.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-5344-1

Vulnerability from osv_ubuntu

Published

2022-04-01 20:31

Modified

2026-06-25 10:46

Summary

libdbd-mysql-perl vulnerabilities

Details

It was discovered that the DBD::mysql module, when configured with server-side prepared statement support, was susceptible to operations that would result in improper memory access. An attacker could possibly use this issue to cause DBD::mysql to crash, resulting in a denial of service. (CVE-2016-1249, CVE-2016-1251)

It was discovered that the DBD::mysql module was susceptible to an operation that would result in improper memory access, introduced through incorrect documentation and code examples. An attacker could possibly use this issue to cause DBD::mysql to crash or potentially cause other, unspecified, impact. (CVE-2017-10788)

It was discovered that the DBD::mysql module processed SSL/TLS settings in a way that did not fully correlate with the respective documentation for each setting. An attacker could possibly use this to perform a cleartext-downgrade attack. (CVE-2017-10789)

References

URL

Type

	https://ubuntu.com/security/notices/USN-5344-1	ADVISORY
	https://ubuntu.com/security/CVE-2016-1249	REPORT
	https://ubuntu.com/security/CVE-2016-1251	REPORT
	https://ubuntu.com/security/CVE-2017-10788	REPORT
	https://ubuntu.com/security/CVE-2017-10789	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-1249",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1251",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-10788",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-10789",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libdbd-mysql-perl",
            "binary_version": "4.033-1ubuntu0.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "libdbd-mysql-perl",
        "purl": "pkg:deb/ubuntu/libdbd-mysql-perl@4.033-1ubuntu0.1+esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.033-1ubuntu0.1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.028-2",
        "4.033-1",
        "4.033-1build1",
        "4.033-1build2",
        "4.033-1ubuntu0.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that the DBD::mysql module, when configured with server-side\nprepared statement support, was susceptible to operations that would result in\nimproper memory access. An attacker could possibly use this issue to cause\nDBD::mysql to crash, resulting in a denial of service.\n(CVE-2016-1249, CVE-2016-1251)\n\nIt was discovered that the DBD::mysql module was susceptible to an operation\nthat would result in improper memory access, introduced through incorrect\ndocumentation and code examples. An attacker could possibly use this issue to\ncause DBD::mysql to crash or potentially cause other, unspecified, impact.\n(CVE-2017-10788)\n\nIt was discovered that the DBD::mysql module processed SSL/TLS settings in a\nway that did not fully correlate with the respective documentation for each\nsetting. An attacker could possibly use this to perform a cleartext-downgrade\nattack. (CVE-2017-10789)\n",
  "id": "USN-5344-1",
  "modified": "2026-06-25T10:46:05Z",
  "published": "2022-04-01T20:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5344-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1249"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1251"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-10788"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-10789"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "libdbd-mysql-perl vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-1249",
    "UBUNTU-CVE-2016-1251",
    "UBUNTU-CVE-2017-10788",
    "UBUNTU-CVE-2017-10789"
  ]
}

usn-7417-1

Vulnerability from osv_ubuntu

Published

2025-04-07 01:37

Modified

2026-02-10 04:47

Summary

libdbd-mysql-perl vulnerabilities

Details

It was discovered that libdbd-mysql-perl did not correctly handle certain SQL queries. An attacker could possibly use this issue to cause a denial of service. (CVE-2016-1249)

It was discovered that libdbd-mysql-perl did not correctly handle certain memory operations, which could lead to a use-after-free vulnerability. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2016-1251, CVE-2017-10788)

It was discovered that libdbd-mysql-perl did not properly enforce SSL connections depending on the mysql_ssl setting. A machine-in-the-middle attacker could possibly use this issue to spoof servers. (CVE-2017-10789)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7417-1	ADVISORY
	https://ubuntu.com/security/CVE-2016-1249	REPORT
	https://ubuntu.com/security/CVE-2016-1251	REPORT
	https://ubuntu.com/security/CVE-2017-10788	REPORT
	https://ubuntu.com/security/CVE-2017-10789	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-1249",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1251",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-10788",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-10789",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libdbd-mysql-perl",
            "binary_version": "4.025-1ubuntu0.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "libdbd-mysql-perl",
        "purl": "pkg:deb/ubuntu/libdbd-mysql-perl@4.025-1ubuntu0.1+esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.025-1ubuntu0.1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.023-1",
        "4.024-1",
        "4.025-1",
        "4.025-1ubuntu0.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that libdbd-mysql-perl did not correctly handle certain\nSQL queries. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2016-1249)\n\nIt was discovered that libdbd-mysql-perl did not correctly handle certain\nmemory operations, which could lead to a use-after-free vulnerability. A\nremote attacker could possibly use this issue to cause a denial of service\nor execute arbitrary code. (CVE-2016-1251, CVE-2017-10788)\n\nIt was discovered that libdbd-mysql-perl did not properly enforce SSL\nconnections depending on the mysql_ssl setting. A machine-in-the-middle\nattacker could possibly use this issue to spoof servers. (CVE-2017-10789)\n",
  "id": "USN-7417-1",
  "modified": "2026-02-10T04:47:48Z",
  "published": "2025-04-07T01:37:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7417-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1249"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1251"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-10788"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-10789"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "libdbd-mysql-perl vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-1249",
    "UBUNTU-CVE-2016-1251",
    "UBUNTU-CVE-2017-10788",
    "UBUNTU-CVE-2017-10789"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2017-10788

Vulnerability from osv_ubuntu

CVE-2017-10788 (GCVE-0-2017-10788)

usn-5344-1

Vulnerability from osv_ubuntu

usn-7417-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature