Debian Patches

Status for libdbi-perl/1.643-4+deb12u2

Patch Description Author Forwarded Bugs Origin Last update
t__06attrs.t__localefix.patch Fix LC_ALL to C in tests Fix LC_ALL to C for the error messages in the statement handle tests Damyan Ivanov <dmn@debian.org> not-needed 2013-05-03
t__40profile.t__NTP.patch A NTP clock adjustment of -0.00967s lead to FTBFS. gregor hermann <gregoa@debian.org> not-needed 2010-10-07
t__80proxy.t___syslogd.patch syslogd isn't necessarily on the buildds Nicholas Bamber <nicholas@periapt.co.uk> no 2010-10-07
spelling.patch fix spelling mistakes in the POD gregor herrmann <gregoa@debian.org> yes upstream vendor 2020-02-08
t-51dbm_file.t-add-test-from-RT-99508.patch [1/2] t/51dbm_file.t: add test from RT#99508
Add test with f_dir="something-not-existing" as reported in RT#99508
to verify when it's fixed for real.		 Jens Rehsack <sno@netbsd.org> yes debian upstream https://github.com/perl5-dbi/dbi/commit/27b10b5c3aacabc091046beaba478e671bb6111c 2020-10-06
lib-DBD-File.pm-fix-CVE-2014-10401.patch [2/2] lib/DBD/File.pm: fix CVE-2014-10401
Dig into the root cause of RT#99508 - which resulted in CVE-2014-10401 - and
figure out that DBI->parse_dsn is the wrong helper to parse our attributes in
DSN, since in DBD::dr::connect only the "dbname" remains from DSN which causes
parse_dsn to bailout.

Parsing on our own similar to parse_dsn shows the way out.		 Jens Rehsack <sno@netbsd.org> yes debian upstream https://github.com/perl5-dbi/dbi/commit/19d0fb169eed475e1c053e99036b8668625cfa94 2020-10-06
Fix-possible-stack-overflow-old-issue-already-noted-.patch Fix possible stack overflow (old issue already noted by Tim) "H.Merijn Brand - Tux" <linux@tux.freedom.nl> no https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e 2026-05-27
Replacing-with-p-in-preparse-with-more-than-9-causes.patch Replacing `?` with `:p#` in `preparse ()` with more than 9 `?` causes buffer overflow

`:p1` is length 3, `?` just 1, but `:p1003` is length 6!		 "H.Merijn Brand - Tux" <linux@tux.freedom.nl> no https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978 2026-05-28
CVE-2026-14739.patch Set a hard limit of 99999 on '?' placeholders "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395 2026-07-04
CVE-2026-14740.patch Fix out-of-bounds read in preparse when an initial comment is deleted

This fixes CVE-2026-14740		 Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01 2026-07-04
CVE-2026-14380/01-b73d5d9.patch Load profile packages using Module::Load Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259 2026-07-01
CVE-2026-14380/02-d982411.patch Add tests for CVE-2026-14380 Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/d982411aec73b3acfc4e9e465358bca9eb7fede8 2026-07-01
CVE-2026-14380/03-f94685f.patch t/40profile.t increase number of tests in the plan Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/f94685f415b08ea4b1f183d48430c4583c1c07d0 2026-07-04
CVE-2026-14380/04-31d2e90.patch Module::Load is required
No known CVE's in that
Installs fine on perl-5.8.0, CORE since 5.9.4		 "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/31d2e90d26db09f47aff4812e65e103cfc2eb3e7 2026-07-05
CVE-2026-14380/05-afa872d.patch Set minimum version of Module::Load to 0.22
This fixes a security issue that allowed code outside of @INC to be
loaded.		 Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/afa872d6cae8a9226779b35a44aeaf6b9b662ec0 2026-07-05
CVE-2026-14380/06-7949e55.patch Improve CVE-2026-14380 tests for Profile Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/7949e551b3c7a8854926b6de84f6cc2ceafb2200 2026-07-06
CVE-2026-14380/07-b638c17.patch Add plan to subtests Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/b638c17320ef10ec939ee50a4e2b144702249bd4 2026-07-06
CVE-2026-14380/08-c22067f.patch Require Test::More 0.96 (tests will otherwise fail on pristine perl-5.12) "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/c22067f642aad085f345f0370bffb7e2fef01f6b 2026-07-06
CVE-2026-15043/01-e9742ef.patch Fix inverted SQL comparisons for strings (CVE-2026-15043)
The <= operator used `ge` and the >= operator used `le`.

Note that this bug has existed since DBI::SQL::Nano was added in DBI 1.42.		 Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d 2026-07-10
CVE-2026-15043/02-44b6b2c.patch Document that DBI::SQL::Nano matches IS NULL against empty strings Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/44b6b2c4af6993cce19557102656c12e828add54 2026-07-10
CVE-2026-15392/01-3f0dae8.patch Do not allow table source locations outside explicit given folders "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/3f0dae81b8a96018f20bdb7a6069427ad9dc8d31 2026-05-27
CVE-2026-15392/02-e2b803b.patch Matching abs_path on relative is bound to fail "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/e2b803bd8309825719b3577d20dc8dc5ac46e059 2026-05-28
CVE-2026-15392/03-605a1fe.patch $searchdir is always set, and the fail is on *use*
Tested with new test case in DBD::CSV		 "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/605a1fe6f80802437c4d8a404f88f51cc46ad0fb 2026-05-28
CVE-2026-15392/04-d9bac9a.patch Extra Cwd::abs_path required for Windows "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/d9bac9ad451ee80066905fcd521c51d652143388 2026-06-05
CVE-2026-15392/05-96d62df.patch Ensure the file is not a symlink outside of f_dir (CVE-2026-15392)
This completes the DBD::File fixes for CVE-2014-10401 and CVE-2014-10402 by
checking that the table file is not a symlink outside of f_dir.		 Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/96d62dfe4528bf56fe13f413ed323d4252531728 2026-07-10
CVE-2026-60082.patch Fix out-of-bounds access in _set_fbav (CVE-2026-60082)
This fixes an out-of-bounds access in _set_fbav (DBI.xs) when a
statement handle has zero fields but a non-empty row.		 Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/397868704291bbf0989b97e2c0661189890653e2 2026-07-10
CVE-2026-60081.patch Add a bound to the path index for the profile parser (CVE-2026-60081)

An untrusted profile dump file can cause a significant memory
amplication.

The workaround creates a $MAX_PATH_DEPTH variable that can be changed to
override the default limit, if it is too small.		 Robert Rothenberg <perl@rhizomnic.com> yes debian upstream https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a 2026-07-10
CVE-2026-73194/01-29b72ae.patch Force placeholder limit on :# and :p# too "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809 2026-08-11
CVE-2026-73194/02-acc903d.patch Fix test for 32bit-perl "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/acc903db3086a737936643a5dbbc0e22f9d5c421#diff-d16060c2c1bb1df5eff8b8cb493bb8d9c96f5110cad360517fd988137bae0ad0 2026-08-17
CVE-2026-73193.patch Limit statements to 292 Mb in preparse "H.Merijn Brand - Tux" <linux@tux.freedom.nl> yes debian upstream https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1 2026-08-11

All known versions for source package 'libdbi-perl'

Links