Описание
ELSA-2026-85916: perl-DBI:1.641 security update (IMPORTANT)
perl-DBI [1.641-11]
- CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting read during numeric type casting Resolves: RHEL-271961
[1.641-10]
- Fix number of tests Resolves: RHEL-247869
[1.641-9]
- Fix placeholder limit on :N and :pN style placeholders (CVE-2026-73194) Resolves: RHEL-247869
[1.641-8]
- Fix unsafe string eval in DBI::Profile (CVE-2026-14380) Resolves: RHEL-211151
[1.641-7]
- Fix patch.
[1.641-6]
- Fix heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739) Resolves: RHEL-193298
[1.641-5]
- Fix stack overflow and buffer overflow in DBI.xs (CVE-2026-9698) Resolves: RHEL-184974
[1.641-4]
- BR: perl(blib), perl(FileHandle) for tests
[1.641-3]
- Rebuild with enable hardening (bug #1636329)
[1.641-2]
- Rebuilding for multicontext errata test purposes (rhbz#1666480)
perl-DBI [1.641-11]
- CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting read during numeric type casting Resolves: RHEL-271961
[1.641-10]
- Fix number of tests Resolves: RHEL-247869
[1.641-9]
- Fix placeholder limit on :N and :pN style placeholders (CVE-2026-73194) Resolves: RHEL-247869
[1.641-8]
- Fix unsafe string eval in DBI::Profile (CVE-2026-14380) Resolves: RHEL-211151
[1.641-7]
- Fix patch.
[1.641-6]
- Fix heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739) Resolves: RHEL-193298
[1.641-5]
- Fix stack overflow and buffer overflow in DBI.xs (CVE-2026-9698) Resolves: RHEL-184974
[1.641-4]
- BR: perl(blib), perl(FileHandle) for tests
[1.641-3]
- Rebuild with enable hardening (bug #1636329)
[1.641-2]
- Rebuilding for multicontext errata test purposes (rhbz#1666480)
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
Module perl-DBI:1.641 is enabled
perl-DBI
1.641-11.module+el8.10.0+91077+1b3056f8
perl-DBI
1.641-11.module+el8.10.0+91078+276323cc
Oracle Linux x86_64
Module perl-DBI:1.641 is enabled
perl-DBI
1.641-11.module+el8.10.0+91077+1b3056f8
perl-DBI
1.641-11.module+el8.10.0+91078+276323cc
Связанные CVE
Связанные уязвимости
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault. This is reachable in Perl using the sql_type_cast function: my $num = 42; DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault. This is reachable in Perl using the sql_type_cast function: my $num = 42; DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault. This is reachable in Perl using the sql_type_cast function: my $num = 42; DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
DBI versions before 1.654 for Perl incorrectly treat numeric values as ...