ELA-1816-1 libdbi-perl security update

Package	libdbi-perl
Version	1.636-1+deb9u4 (stretch), 1.642-1+deb10u4 (buster)
Related CVEs	CVE-2026-14380 CVE-2026-14739 CVE-2026-14740 CVE-2026-15043 CVE-2026-15392 CVE-2026-60081 CVE-2026-60082 CVE-2026-73193 CVE-2026-73194

CVE-2026-14380

Missing input validation when interpolating the package name in a string eval may lead to arbitrary Perl code execution from an attacker controlling the Profile attribute, for instance via the DBI_PROFILE environment variable or a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.

CVE-2026-14739

Preparsing SQL statements with an excessively high (over one million) number of placeholders could lead to heap overflow.

This update sets a hard limit of 99999 placeholders.

CVE-2026-14740

Preparsing an SQL statement starting with a comment line could lead to an out-of-bounds read by one byte.

CVE-2026-15043

DBI::SQL::Nano, DBI’s built-in mini-SQL engine, evaluated WHERE predicates by incorrectly inverting <= and >= SQL operators on text, which may lead to file-backed filter bypass.

CVE-2026-15392

DBD::File did not check whether the table file is a symbolic link, which may lead to path traversal if the target points outside the f_dir and f_dir_search directories.

This issue stems from an incomplete fix for CVE-2014-10401 and CVE-2014-10402.

CVE-2026-60081

DBI::ProfileData did not limit the path index when parsing a profile-dump file, which may lead to denial of service.

This updates adds a configurable maximum path depth variable $DBI::Profile::MAX_PATH_DEPTH, with a default value of 256.

CVE-2026-60082

Missing statement handle consistency checks could lead to an out-of-bounds read when a statement handle had no fields and the source row was non-empty.

CVE-2026-73193

A heap out-of-bounds write issue was found on 32-bit platforms due to integer overflow in the output buffer size computed by the preparse() function.

This updates limits the size of SQL statements to 292 MiB.

CVE-2026-73194

A heap out-of-bounds write issue was found due to unvalidated numeric placeholder in the preparse() function.

This issue stems from an incomplete fix for CVE-2026-14739.

For Debian 10 buster, these problems have been fixed in version 1.642-1+deb10u4.

For Debian 9 stretch, these problems have been fixed in version 1.636-1+deb9u4.

We recommend that you upgrade your libdbi-perl packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.