Summary
perl-DBI
[1.641-11]
- CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting
read during numeric type casting
Resolves: RHEL-271961
[1.641-10]
- Fix number of tests
Resolves: RHEL-247869
[1.641-9]
- Fix placeholder limit on :N and :pN style placeholders (CVE-2026-73194)
Resolves: RHEL-247869
[1.641-8]
- Fix unsafe string eval in DBI::Profile (CVE-2026-14380)
Resolves: RHEL-211151
[1.641-7]
- Fix patch.
[1.641-6]
- Fix heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)
Resolves: RHEL-193298
[1.641-5]
- Fix stack overflow and buffer overflow in DBI.xs (CVE-2026-9698)
Resolves: RHEL-184974
[1.641-4]
- BR: perl(blib), perl(FileHandle) for tests
[1.641-3]
- Rebuild with enable hardening (bug #1636329)
[1.641-2]
- Rebuilding for multicontext errata test purposes (rhbz#1666480)
perl-DBI
[1.641-11]
- CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting
read during numeric type casting
Resolves: RHEL-271961
[1.641-10]
- Fix number of tests
Resolves: RHEL-247869
[1.641-9]
- Fix placeholder limit on :N and :pN style placeholders (CVE-2026-73194)
Resolves: RHEL-247869
[1.641-8]
- Fix unsafe string eval in DBI::Profile (CVE-2026-14380)
Resolves: RHEL-211151
[1.641-7]
- Fix patch.
[1.641-6]
- Fix heap overflow when preparsing SQL statements with excessive placeholders (CVE-2026-14739)
Resolves: RHEL-193298
[1.641-5]
- Fix stack overflow and buffer overflow in DBI.xs (CVE-2026-9698)
Resolves: RHEL-184974
[1.641-4]
- BR: perl(blib), perl(FileHandle) for tests
[1.641-3]
- Rebuild with enable hardening (bug #1636329)
[1.641-2]
- Rebuilding for multicontext errata test purposes (rhbz#1666480)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | perl-DBI | 0:1.641-11.module+el8.10.0+91078+276323cc |
Vulnerabilities 1
-
Medium 6.2
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) …