Summary
The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.
Security Fix(es):
* perl-DBI: DBI: Loading of arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM (CVE-2026-78030)
* perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | perl-DBI | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI-debuginfo | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI-debuginfo | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI-debuginfo | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI-debuginfo | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI-debugsource | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI-debugsource | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI-debugsource | 0:1.643-12.el9_9.3 |
| Rocky Linux · 9 | perl-DBI-debugsource | 0:1.643-12.el9_9.3 |
Vulnerabilities 2
-
Critical 9.8
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a …
-
Medium 6.2
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) …