From 96c4974b81d6ed2c69bdeea09eb489239005d6d5 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 13 Jul 2026 12:14:29 -0400 Subject: [PATCH] import UBI perl-DBI-1.643-26.el10_2.1 --- DBI-1.643-Fix-CVE-2026-9698.patch | 66 +++++++++++++++++++++++++++++++ perl-DBI.spec | 8 +++- 2 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 DBI-1.643-Fix-CVE-2026-9698.patch diff --git a/DBI-1.643-Fix-CVE-2026-9698.patch b/DBI-1.643-Fix-CVE-2026-9698.patch new file mode 100644 index 0000000..60d125a --- /dev/null +++ b/DBI-1.643-Fix-CVE-2026-9698.patch @@ -0,0 +1,66 @@ +From d5b5afaeafead1becddf34c7b37289f81316755a Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Wed, 27 May 2026 11:16:50 +0200 +Subject: [PATCH 1/2] Fix possible stack overflow (old issue already noted by + Tim) + +--- + DBI.xs | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index 2cea4ac..c549d15 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -3998,7 +3998,6 @@ XS(XS_DBI_dispatch) + SV **statement_svp = NULL; + const int is_warning = (!SvTRUE(err_sv) && strlen(SvPV_nolen(err_sv))==1); + const char *err_meth_name = meth_name; +- char intro[200]; + + if (meth_type == methtype_set_err) { + SV **sem_svp = hv_fetch((HV*)SvRV(h), "dbi_set_err_method", 18, GV_ADDWARN); +@@ -4006,10 +4005,8 @@ XS(XS_DBI_dispatch) + err_meth_name = SvPV_nolen(*sem_svp); + } + +- /* XXX change to vsprintf into sv directly */ +- sprintf(intro,"%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name, +- SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information"); +- msg = sv_2mortal(newSVpv(intro,0)); ++ msg = sv_2mortal(newSVpvf("%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name, ++ SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information")); + if (SvOK(DBIc_ERRSTR(imp_xxh))) + sv_catsv(msg, DBIc_ERRSTR(imp_xxh)); + else +-- +2.52.0 + + +From ed8ebc5aa6cadbc010ac694eef324c164717dad5 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Thu, 28 May 2026 14:14:50 +0200 +Subject: [PATCH 2/2] Replacing `?` with `:p#` in `preparse ()` with more than + 9 `?` causes buffer overflow + +`:p1` is length 3, `?` just 1, but `:p1003` is length 6! +--- + DBI.xs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index c549d15..8858e21 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4201,7 +4201,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + } + + /* XXX this allocation strategy won't work when we get to more advanced stuff */ +- new_stmt_sv = newSV(strlen(statement) * 3); ++ new_stmt_sv = newSV(strlen(statement) * 6 + 16); + sv_setpv(new_stmt_sv,""); + src = statement; + dest = SvPVX(new_stmt_sv); +-- +2.52.0 + diff --git a/perl-DBI.spec b/perl-DBI.spec index 90e428e..1ec622e 100644 --- a/perl-DBI.spec +++ b/perl-DBI.spec @@ -34,7 +34,7 @@ Name: perl-DBI Version: 1.643 -Release: 26%{?dist} +Release: 26%{?dist}.1 Summary: A database access API for perl License: GPL-1.0-or-later OR Artistic-1.0-Perl URL: http://dbi.perl.org/ @@ -44,6 +44,8 @@ Patch0: DBI-1.643-Fix-for-CVE-2014-10401.patch Patch1: DBI-1.643-Fix-for-empty-attributes-in-DSN.patch Patch2: DBI-1.643-Catch-warning.patch Patch3: DBI-1.643-Document-the-new-behavior-for-f_dir.patch +# RHEL-184980, CVE-2026-9698, Fix possible stack overflow and buffer overflow in DBI.xs +Patch4: DBI-1.643-Fix-CVE-2026-9698.patch BuildRequires: coreutils BuildRequires: findutils BuildRequires: gcc @@ -277,6 +279,10 @@ make test %{_libexecdir}/%{name} %changelog +* Fri Jun 19 2026 RHEL Packaging Agent - 1.643-26.1 +- Fix CVE-2026-9698: stack overflow and buffer overflow in DBI.xs +- Resolves: RHEL-184980 + * Tue Oct 29 2024 Troy Dawson - 1.643-26 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018