A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service or integrity of data.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5030-2 advisory.

  - An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from     folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE:
    this issue exists because of an incomplete fix for CVE-2014-10401. (CVE-2014-10402)

  - A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service     or integrity of data. (CVE-2020-14393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5030-1 advisory.

  - An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from     folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE:
    this issue exists because of an incomplete fix for CVE-2014-10401. (CVE-2014-10402)

  - A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service     or integrity of data. (CVE-2020-14393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - A buffer overflow was found in perl-DBI before version     1.643 in DBI.xs. This flaw allows a local attacker who     can supply a string longer than 300 characters to cause     an out-of-bounds write. The highest threat from this     vulnerability is to integrity and system     availability.(CVE-2020-14393)

  - An untrusted pointer dereference flaw was found in     Perl-DBI before version 1.643. This flaw allows a local     attacker who can manipulate calls to dbd_db_login6_sv()     to cause memory corruption. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14493-1 advisory.

  - An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's     availability. (CVE-2020-14392)

  - A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service     or integrity of data. (CVE-2020-14393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

Security issues fixed :

CVE-2020-14392: Memory corruption in XS functions when Perl stack is reallocated (bsc#1176412).

CVE-2020-14393: Fixed a buffer overflow on an overlong DBD class name (bsc#1176409).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the Perl5 Database Interface (DBI). An attacker could trigger a denial of service (DoS) and possibly execute arbitrary code.

CVE-2019-20919

The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.

CVE-2020-14392

An untrusted pointer dereference flaw was found in Perl-DBI. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.

CVE-2020-14393

A buffer overflow on via an overlong DBD class name in dbih_setup_handle function may lead to data be written past the intended limit.

For Debian 9 stretch, these problems have been fixed in version 1.636-1+deb9u1.

We recommend that you upgrade your libdbi-perl packages.

For the detailed security status of libdbi-perl please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libdbi-perl

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release fixes CVE-2020-14392 (a memory corruption in XS functions when Perl stack is reallocated), CVE-2019-20919 (a NULL profile dereference in dbi_profile()), a documentation that old API functions are vulnerable to an overflow, and CVE-2020-14393 (a buffer overlfow on an overlong DBD class name). It also adds a missing dependency on FileHandle Perl module.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

Security issues fixed :

  - CVE-2020-14392: Memory corruption in XS functions when     Perl stack is reallocated (bsc#1176412).

  - CVE-2020-14393: Fixed a buffer overflow on an overlong     DBD class name (bsc#1176409).

This update was imported from the SUSE:SLE-15:Update update project.

This update for perl-DBI fixes the following issues :

Security issues fixed :

  - CVE-2020-14392: Memory corruption in XS functions when     Perl stack is reallocated (bsc#1176412).

  - CVE-2020-14393: Fixed a buffer overflow on an overlong     DBD class name (bsc#1176409).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote host is affected by the vulnerability described in GLSA-202009-07 (Perl DBI: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Perl module DBI.
      Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
157372	Ubuntu 16.04 ESM : Perl DBI module vulnerabilities (USN-5030-2)	Nessus	Ubuntu Local Security Checks	high
152230	Ubuntu 18.04 LTS / 20.04 LTS : Perl DBI module vulnerabilities (USN-5030-1)	Nessus	Ubuntu Local Security Checks	high
151418	EulerOS Virtualization 3.0.2.2 : perl-DBI (EulerOS-SA-2021-2158)	Nessus	Huawei Local Security Checks	high
151304	EulerOS Virtualization for ARM 64 3.0.2.0 : perl-DBI (EulerOS-SA-2021-2112)	Nessus	Huawei Local Security Checks	high
150595	SUSE SLES11 Security Update : perl-DBI (SUSE-SU-2020:14493-1)	Nessus	SuSE Local Security Checks	high
147693	EulerOS Virtualization 2.9.0 : perl-DBI (EulerOS-SA-2021-1650)	Nessus	Huawei Local Security Checks	high
147556	EulerOS Virtualization 2.9.1 : perl-DBI (EulerOS-SA-2021-1622)	Nessus	Huawei Local Security Checks	high
147132	EulerOS Virtualization 3.0.6.6 : perl-DBI (EulerOS-SA-2021-1510)	Nessus	Huawei Local Security Checks	high
147044	EulerOS Virtualization for ARM 64 3.0.6.0 : perl-DBI (EulerOS-SA-2021-1552)	Nessus	Huawei Local Security Checks	high
145186	EulerOS 2.0 SP3 : perl-DBI (EulerOS-SA-2021-1109)	Nessus	Huawei Local Security Checks	high
144233	EulerOS 2.0 SP5 : perl-DBI (EulerOS-SA-2020-2559)	Nessus	Huawei Local Security Checks	high
143835	SUSE SLES12 Security Update : perl-DBI (SUSE-SU-2020:2661-1)	Nessus	SuSE Local Security Checks	high
143733	SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2020:2645-1)	Nessus	SuSE Local Security Checks	high
143715	SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2020:2646-1)	Nessus	SuSE Local Security Checks	high
142336	EulerOS 2.0 SP9 : perl-DBI (EulerOS-SA-2020-2435)	Nessus	Huawei Local Security Checks	high
142312	EulerOS 2.0 SP2 : perl-DBI (EulerOS-SA-2020-2382)	Nessus	Huawei Local Security Checks	high
142252	EulerOS 2.0 SP9 : perl-DBI (EulerOS-SA-2020-2417)	Nessus	Huawei Local Security Checks	high
142164	EulerOS 2.0 SP8 : perl-DBI (EulerOS-SA-2020-2315)	Nessus	Huawei Local Security Checks	high
140934	Debian DLA-2386-1 : libdbi-perl security update	Nessus	Debian Local Security Checks	high
140817	Fedora 31 : perl-DBI (2020-f30298614a)	Nessus	Fedora Local Security Checks	high
140744	openSUSE Security Update : perl-DBI (openSUSE-2020-1502)	Nessus	SuSE Local Security Checks	high
140691	openSUSE Security Update : perl-DBI (openSUSE-2020-1483)	Nessus	SuSE Local Security Checks	high
140562	GLSA-202009-07 : Perl DBI: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2020-14393

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high