A security issue in perl-DBD-mysql has been reported: http://openwall.com/lists/oss-security/2016/07/25/13 It is fixed in 4.034 and a patch is linked in the message above. Mageia 5 is also affected.
CC: (none) => guillomovitch, mageia
Whiteboard: (none) => MGA5TOO
CVE-2015-8949 has been assigned: http://openwall.com/lists/oss-security/2016/07/27/1
Summary: perl-DBD-mysql new use-after-free security issue => perl-DBD-mysql new use-after-free security issue (CVE-2015-8949)
CVE-2014-9906 assigned for an issue fixed in 4.029 (Mageia 5 has 4.028): http://openwall.com/lists/oss-security/2016/07/27/6 Commit to fix it also linked in the message above.
Summary: perl-DBD-mysql new use-after-free security issue (CVE-2015-8949) => perl-DBD-mysql new use-after-free security issues (CVE-2014-9906 and CVE-2015-8949)
perl-DBD-mysql-4.35.0-1.mga6 uploaded for Cauldron by Guillaume.
Version: Cauldron => 5Whiteboard: MGA5TOO => (none)
Debian has issued an advisory for this on July 29: https://www.debian.org/security/2016/dsa-3635
URL: (none) => http://lwn.net/Vulnerabilities/695956/
Patched package submitted for Mageia 5. Advisory: ======================== Updated perl-DBD-mysql package fixes security vulnerabilities: Two use-after-free vulnerabilities were discovered in DBD::mysql. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using DBD::mysql (application crash), or potentially to execute arbitrary code with the privileges of the user running the application (CVE-2014-9906, CVE-2015-8949). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9906 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8949 https://www.debian.org/security/2016/dsa-3635 ======================== Updated packages in core/updates_testing: ======================== perl-DBD-mysql-4.28.0-3.1.mga5 from perl-DBD-mysql-4.28.0-3.1.mga5.src.rpm
Assignee: jquelin => qa-bugs
Validating based on the update installing cleanly.
Keywords: (none) => validated_updateWhiteboard: (none) => advisory, MGA5-32-OKCC: (none) => davidwhodgins, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0300.html
Status: NEW => RESOLVEDResolution: (none) => FIXED