CVE catalog

CVE-2016-1249

libdbd-mysql-perl: CVE-2016-1249

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.43% · Oct 25, 2026

The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibdbd-mysql-perlsid4.055-1fixed
Debianlibdbd-mysql-perlforky4.055-1fixed
Debianlibdbd-mysql-perltrixie4.053-1fixed
Debianlibdbd-mysql-perlbookworm4.050-5fixed
Ubuntulibdbd-mysql-perlpro4.028-2vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1build1vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1build2vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1ubuntu0.1vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1ubuntu0.1+esm1fixed
Ubuntulibdbd-mysql-perlpro4.023-1vulnerable
Ubuntulibdbd-mysql-perlpro4.024-1vulnerable
Ubuntulibdbd-mysql-perlpro4.025-1vulnerable
Ubuntulibdbd-mysql-perlpro4.025-1ubuntu0.1vulnerable
Ubuntulibdbd-mysql-perlpro4.025-1ubuntu0.1+esm1fixed
Ubuntulibdbd-mysql-perlpro4.028-2vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1build1vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1build2vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1ubuntu0.1vulnerable
Ubuntulibdbd-mysql-perlpro4.033-1ubuntu0.1+esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibdbd-mysql-perlsourcesid4.039-1not yet assignedNot reported[844475]
Debianlibdbd-mysql-perlsourceforky4.039-1not yet assignedNot reported[844475]
Debianlibdbd-mysql-perlsourcetrixie4.039-1not yet assignedNot reported[844475]
Debianlibdbd-mysql-perlsourcebookworm4.039-1not yet assignedNot reported[844475]
Ubuntulibdbd-mysql-perldebpro4.033-1ubuntu0.1+esm1Not reportedUSN-5344-1Not reported
Ubuntulibdbd-mysql-perldebpro4.025-1ubuntu0.1+esm1Not reportedUSN-7417-1Not reported
Ubuntulibdbd-mysql-perldebpro4.033-1ubuntu0.1+esm1Not reportedUBUNTU-CVE-2016-1249Not reported

[Debian bug #844475]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libdbd-mysql-perl]Fixed

    Source package: [libdbd-mysql-perl]

    Details (2)

    • 4.050-5+b1 · amd64 · bookworm

      Fixed · Fixed: 4.039-1

      dsa · libdbd-mysql-perl · debian · bookworm; dsa · libdbd-mysql-perl · debian · 12

    • 4.050-5+b1 · arm64 · bookworm

      Fixed · Fixed: 4.039-1

      dsa · libdbd-mysql-perl · debian · bookworm; dsa · libdbd-mysql-perl · debian · 12

[Debian 13 (Trixie)]

  • [libdbd-mysql-perl]Fixed
    Details (2)

    • 4.053-1 · amd64 · trixie

      Fixed · Fixed: 4.039-1

      dsa · libdbd-mysql-perl · debian · 13

    • 4.053-1 · arm64 · trixie

      Fixed · Fixed: 4.039-1

      dsa · libdbd-mysql-perl · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]