An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for Callbacks may lead to memory corruption.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - perl-dbi: Buffer overflow on an overlong DBD class name (CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for     Callbacks may lead to memory corruption. (CVE-2013-7490)

  - An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-     defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.
    (CVE-2013-7491)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14510-1 advisory.

  - An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for     Callbacks may lead to memory corruption. (CVE-2013-7490)

  - An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-     defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.
    (CVE-2013-7491)

  - An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL     pointer dereference. (CVE-2019-20919)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for perl-DBI fixes the following issues :

CVE-2019-20919: Fixed a NULL profile dereference in dbi_profile (bsc#1176764).

CVE-2013-7490: Fixed memory corruption when using many arguments to methods for CallbacksUsing (bsc#1176496).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199516	RHEL 7 : perl-dbi (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
150556	SUSE SLES11 Security Update : perl-DBI (SUSE-SU-2020:14510-1)	Nessus	SuSE Local Security Checks	medium
143690	SUSE SLES12 Security Update : perl-DBI (SUSE-SU-2020:2856-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2013-7490

medium

Tenable Plugins

high

medium

medium