Description
Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the pg_warn function or (2) a crafted DBD statement to the dbd_st_prepare function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libdbd-pg-perl | 2.19.0-1 | — |
| Debian 13 | libdbd-pg-perl | 2.19.0-1 | — |
| Debian 12 | libdbd-pg-perl | 2.19.0-1 | — |
| Debian 6.0 | libdbd-pg-perl | 2.17.1-2+squeeze1 | DSA-2431-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perl-DBD-Pg | 2.15.1-4.el6_3 | RHSA-2012:1116 |
| RHEL 5 | perl-DBD-Pg | 1.49-4.el5_8 | RHSA-2012:1116 |
Advisories 2
- RHSA-2012:1116 Red Hat Security Advisory: perl-DBD-Pg security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2431-1 libdbd-pg-perl - format string vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20120309 Re: CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws mailing-list
- MDVSA-2012:112 vendor-advisory
- dbdpg-pgwarn-format-string(73854) vdb-entry
- 48307 third-party-advisory
- RHSA-2012:1116 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661536
- http://cpansearch.perl.org/src/TURNSTEP/DBD-Pg-2.19.1/Changes
- https://bugzilla.redhat.com/show_bug.cgi?id=801733
- [oss-security] 20120309 CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws mailing-list
- 48319 third-party-advisory
- dbdpg-dbdstprepare-format-string(73855) vdb-entry
- GLSA-201204-08 vendor-advisory
- DSA-2431 vendor-advisory
- 48824 third-party-advisory
- https://rt.cpan.org/Public/Bug/Display.html?id=75642