Описание
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.
When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.
This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.
A flaw was found in perl-DBI, a database interface for Perl. This vulnerability arises when the DBI library processes inconsistent data, specifically when a statement handle lacks fields but is associated with a non-empty data row. This inconsistency can cause the internal row-buffer to attempt reading from an invalid memory location, an out-of-bounds read. An attacker could exploit this by supplying malformed metadata and rows to the prepare method, potentially leading to application instability or a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | perl-DBI | Fix deferred | ||
| Red Hat Enterprise Linux 6 | perl-DBI | Out of support scope | ||
| Red Hat Enterprise Linux 7 | perl-DBI | Out of support scope | ||
| Red Hat Enterprise Linux 8 | perl-DBI | Fix deferred | ||
| Red Hat Enterprise Linux 8 | perl-DBI:1.641/perl-DBI | Fix deferred | ||
| Red Hat Enterprise Linux 9 | perl-DBI | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
3.3 Low
CVSS3
Связанные уязвимости
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row
DBI versions before 1.651 for Perl do not enforce statement handle con ...
EPSS
3.3 Low
CVSS3