Description
Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libdbd-pg-perl | 2.1.3-1 | — |
| Debian 13 | libdbd-pg-perl | 2.1.3-1 | — |
| Debian 12 | libdbd-pg-perl | 2.1.3-1 | — |
| Debian 4.0 | libdbd-pg-perl | 1.49-2+etch1 | DSA-1780-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | perl-DBD-Pg | 1.49-2.el5_3.1 | RHSA-2009:0479 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.11-2.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | mod_jk +1 | 1.2.28-2.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.11-2.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | mysql +6 | 5.0.79-2.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | mysql-connector-odbc | 3.51.27r695-1.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | perl-DBD-MySQL | 4.010-1.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | perl-DBD-Pg | 1.49-5.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | php +18 | 5.2.9-2.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | postgresql +11 | 8.2.13-2.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | postgresql-jdbc | 8.2.509-2jpp.el5s2 | RHSA-2009:1067 |
| Red Hat Rhel Application Stack 2 | postgresqlclient81 | 8.1.17-1.el5s2 | RHSA-2009:1067 |
Advisories 3
- RHSA-2009:0479 Red Hat Security Advisory: perl-DBD-Pg security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1780-1 libdbd-pg-perl - potential code execution Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1067 Red Hat Security Advisory: Red Hat Application Stack v2.3 security and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2009:1067 vendor-advisory
- 34757 vdb-entry
- http://security.debian.org/pool/updates/main/libd/libdbd-pg-perl/libdbd-pg-perl_1.49-2+etch1.diff.gz
- https://launchpad.net/bugs/cve/2009-1341
- 34909 third-party-advisory
- RHSA-2009:0479 vendor-advisory
- 35685 third-party-advisory
- oval:org.mitre.oval:def:9680 vdb-entry signature
- http://cpansearch.perl.org/src/TURNSTEP/DBD-Pg-2.13.1/Changes
- DSA-1780 vendor-advisory
- SUSE-SR:2009:012 vendor-advisory
- 35058 third-party-advisory
- http://rt.cpan.org/Public/Bug/Display.html?id=21392
- libdbdpgperl-dequotebytea-dos(50387) vdb-entry