https://bugzilla.redhat.com/show_bug.cgi?id=1877447
Bug ID: 1877447 Summary: perl-dbi: Stack corruption on callbacks Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: caillon+fedoraproject@gmail.com, hhorak@redhat.com, john.j5live@gmail.com, jorton@redhat.com, jplesnik@redhat.com, kasal@ucw.cz, perl-devel@lists.fedoraproject.org, perl-maint-list@redhat.com, ppisar@redhat.com, rhughes@redhat.com, rstrode@redhat.com, sandmann@redhat.com Target Milestone: --- Classification: Other
A flaw was found in perl-dbi before version 1.628. A problem occurs when a user-defined function requires a non-trivial amount of memory and the perl stack gets reallocated.
References:
https://rt.cpan.org/Public/Bug/Display.html?id=85562
Upstream patch:
https://github.com/perl5-dbi/dbi/commit/401f1221311c71f760e21c98772f0f7e3cbe...
https://bugzilla.redhat.com/show_bug.cgi?id=1877447
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1857388
https://bugzilla.redhat.com/show_bug.cgi?id=1877447
Todd Cullum tcullum@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |low Severity|medium |low
https://bugzilla.redhat.com/show_bug.cgi?id=1877447
Todd Cullum tcullum@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1877962
https://bugzilla.redhat.com/show_bug.cgi?id=1877447
Todd Cullum tcullum@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|perl-dbi: Stack corruption |CVE-2013-7491 perl-dbi: |on callbacks |Stack corruption on | |callbacks Alias| |CVE-2013-7491
https://bugzilla.redhat.com/show_bug.cgi?id=1877447
--- Comment #3 from Todd Cullum tcullum@redhat.com --- Statement:
perl-DBI as shipped in Red Hat Enterprise Linux 8, rhscl-3 rh-perl526-perl-DBI and rhscl-3 rh-perl530-perl-DBI are notaffected by this flaw as the vulnerable code has already been patched in versions of perl-DBI shipped in these products.
https://bugzilla.redhat.com/show_bug.cgi?id=1877447
Todd Cullum tcullum@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed| |2021-11-02 17:39:02
perl-devel@lists.fedoraproject.org