Description
The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2, allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving subroutine references and delayed execution.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.12.3-1 | — |
| Debian 13 | perl | 5.12.3-1 | — |
| Debian 12 | perl | 5.12.3-1 | — |
| Debian 6.0 | perl | 5.10.1-17squeeze2 | DSA-2267-1 |
| Debian 5.0 | perl | 5.10.0-19lenny5 | DSA-2267-1 |
| Debian 5.0 | postgresql-8.3 | 8.3.11-0lenny1 | DSA-2051-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | perl +1 | 4:5.8.8-32.el5_5.1 | RHSA-2010:0458 |
| RHEL 4 | perl +1 | 3:5.8.5-53.el4 | RHSA-2010:0457 |
| RHEL 3 | perl +1 | 2:5.8.0-101.EL3 | RHSA-2010:0457 |
| RHEL 3 | perl-CGI | 2:2.89-101.EL3 | RHSA-2010:0457 |
| RHEL 3 | perl-CPAN | 2:1.61-101.EL3 | RHSA-2010:0457 |
| RHEL 3 | perl-DB_File | 2:1.806-101.EL3 | RHSA-2010:0457 |
Advisories 4
- RHSA-2010:0457 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0458 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2051-1 postgresql-8.3 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2267-1 perl - restriction bypass Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2010:115 vendor-advisory
- DSA-2267 vendor-advisory
- http://security-tracker.debian.org/tracker/CVE-2010-1447
- oval:org.mitre.oval:def:7320 vdb-entry signature
- http://www.postgresql.org/about/news.1203
- ADV-2010-1167 vdb-entry
- 39845 third-party-advisory
- oval:org.mitre.oval:def:11530 vdb-entry signature
- https://bugs.launchpad.net/bugs/cve/2010-1447
- 64756 vdb-entry
- RHSA-2010:0457 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 40049 third-party-advisory
- 40052 third-party-advisory
- RHSA-2010:0458 vendor-advisory
- 1023988 vdb-entry
- [oss-security] 20100520 CVE-2010-1974 reject request (dupe of CVE-2010-1168) and CVE-2010-1447 description modification request mailing-list
- 40305 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=588269
- MDVSA-2010:116 vendor-advisory