Affected: AlmaLinux:8: perl-DBI

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

* perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. (CVE-2026-10879) * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698) * DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-14380) * DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: perl-dbi, Alpaquita:25: perl-dbi, Alpaquita:stream: perl-dbi

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.

The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.

The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

Affected: openEuler:20.03-LTS-SP4: perl-DBI, openEuler:22.03-LTS-SP4: perl-DBI, openEuler:24.03-LTS-SP1: perl-DBI, openEuler:24.03-LTS-SP3: perl-DBI

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue" between an application and one or more database driver modules. It is the driver modules which do most of the real work. The DBI provides a standard interface and framework for the drivers to operate within. Security Fix(es):

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.

The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.(CVE-2026-10879)

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.

Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit.

Attackers that can influence the error text in an application can trigger a buffer overflow.(CVE-2026-9698)

perl-DBI-1.648.0-1.1 on GA media

httpd: incomplete fix for CVE-2023-38709 libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling glibc: glibc: Out-of-bounds write via TSIG record processing glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings glibc: glibc: Application crash or uninitialized memory read via crafted DNS response DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation httpd: NULL pointer dereference via specially crafted request httpd: mod_auth_digest: timing attack allows a bypass of digest authentication httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc httpd: Apache HTTP S…

Affected: Rocky Linux:9: perl-DBI

DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

* DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security update for perl-DBI

Affected: Ubuntu:Pro:14.04:LTS: libdbi-perl, Ubuntu:Pro:16.04:LTS: libdbi-perl, Ubuntu:Pro:18.04:LTS: libdbi-perl, Ubuntu:Pro:20.04:LTS: libdbi-perl, Ubuntu:22.04:LTS: libdbi-perl, Ubuntu:24.04:LTS: libdbi-perl, Ubuntu:25.10: libdbi-perl, Ubuntu:26.04:LTS: libdbi-perl

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.