CVE-2009-4484: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 69.6% chance of exploitation in the next 30 days.

Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only; version 9.10 only; version 10.04 only; …
• Debian Debian Linux: version 4.0 only; version 5.0 only; version 6.0 only
• MariaDB MariaDB: from 5.1, before 5.1.42 (fixed in 5.1.42)
• Oracle MySQL: from 5.0.0, before 5.0.90 (fixed in 5.0.90); from 5.1.0, before 5.1.43 (fixed in 5.1.43); version 5.0.0 only
• wolfSSL Yassl: before 1.9.9 (fixed in 1.9.9)

Published 2009-12-30. Last modified 2026-06-16.