An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3035 advisory.

  - An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from     folders other than those specifically passed via the f_dir attribute. (CVE-2014-10401)

  - An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from     folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE:
    this issue exists because of an incomplete fix for CVE-2014-10401. (CVE-2014-10402)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - A buffer overflow was found in perl-DBI before version     1.643 in DBI.xs. This flaw allows a local attacker who     can supply a string longer than 300 characters to cause     an out-of-bounds write. The highest threat from this     vulnerability is to integrity and system     availability.(CVE-2020-14393)

  - An untrusted pointer dereference flaw was found in     Perl-DBI before version 1.643. This flaw allows a local     attacker who can manipulate calls to dbd_db_login6_sv()     to cause memory corruption. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). [bsc#1176492, CVE-2014-10401, CVE-2014-10402]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

DBD::File drivers could open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). [bsc#1176492, CVE-2014-10401, CVE-2014-10402]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

  - DBD::File drivers could open files from folders other     than those specifically passed via the f_dir attribute     in the data source name (DSN). [bsc#1176492,     CVE-2014-10401, CVE-2014-10402]

This update was imported from the SUSE:SLE-15:Update update project.

This update for perl-DBI fixes the following issues :

  - DBD::File drivers can open files from folders other than     those specifically passed via the f_dir attribute in the     data source name (DSN). [bsc#1176492, CVE-2014-10401,     CVE-2014-10402]

This update was imported from the SUSE:SLE-15-SP2:Update update project.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
161684	Debian DLA-3035-1 : libdbi-perl - LTS security update	Nessus	Debian Local Security Checks	medium
151418	EulerOS Virtualization 3.0.2.2 : perl-DBI (EulerOS-SA-2021-2158)	Nessus	Huawei Local Security Checks	high
151304	EulerOS Virtualization for ARM 64 3.0.2.0 : perl-DBI (EulerOS-SA-2021-2112)	Nessus	Huawei Local Security Checks	high
147693	EulerOS Virtualization 2.9.0 : perl-DBI (EulerOS-SA-2021-1650)	Nessus	Huawei Local Security Checks	high
147132	EulerOS Virtualization 3.0.6.6 : perl-DBI (EulerOS-SA-2021-1510)	Nessus	Huawei Local Security Checks	high
145186	EulerOS 2.0 SP3 : perl-DBI (EulerOS-SA-2021-1109)	Nessus	Huawei Local Security Checks	high
144233	EulerOS 2.0 SP5 : perl-DBI (EulerOS-SA-2020-2559)	Nessus	Huawei Local Security Checks	high
143879	SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2020:3384-1)	Nessus	SuSE Local Security Checks	medium
143676	SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2020:3385-1)	Nessus	SuSE Local Security Checks	medium
143355	openSUSE Security Update : perl-DBI (openSUSE-2020-2051)	Nessus	SuSE Local Security Checks	medium
143331	openSUSE Security Update : perl-DBI (openSUSE-2020-2064)	Nessus	SuSE Local Security Checks	medium
142312	EulerOS 2.0 SP2 : perl-DBI (EulerOS-SA-2020-2382)	Nessus	Huawei Local Security Checks	high
141339	EulerOS 2.0 SP9 : perl-DBI (EulerOS-SA-2020-2180)	Nessus	Huawei Local Security Checks	medium
141333	EulerOS 2.0 SP9 : perl-DBI (EulerOS-SA-2020-2170)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2014-10401

medium

Tenable Plugins

medium

high

high

high

high

high

high

medium

medium

medium

medium

high

medium

medium