From e987fd7336a0b2c39e14965f0a489e4f82fdf6ad Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 13 Jul 2026 09:35:03 -0400 Subject: [PATCH] import CS git perl-DBI-1.641-5.el8 --- SOURCES/DBI-1.641-Fix-CVE-2026-9698.patch | 66 +++++++++++++++++++++++ SPECS/perl-DBI.spec | 9 +++- 2 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 SOURCES/DBI-1.641-Fix-CVE-2026-9698.patch diff --git a/SOURCES/DBI-1.641-Fix-CVE-2026-9698.patch b/SOURCES/DBI-1.641-Fix-CVE-2026-9698.patch new file mode 100644 index 0000000..57d3313 --- /dev/null +++ b/SOURCES/DBI-1.641-Fix-CVE-2026-9698.patch @@ -0,0 +1,66 @@ +From 73fa0162f834094189c4e7f4a24e165f5d3bbe5c Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Wed, 27 May 2026 11:16:50 +0200 +Subject: [PATCH 1/2] Fix possible stack overflow (old issue already noted by + Tim) + +--- + DBI.xs | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index 3b55e56..53d68b1 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4012,7 +4012,6 @@ XS(XS_DBI_dispatch) + SV **statement_svp = NULL; + const int is_warning = (!SvTRUE(err_sv) && strlen(SvPV_nolen(err_sv))==1); + const char *err_meth_name = meth_name; +- char intro[200]; + + if (meth_type == methtype_set_err) { + SV **sem_svp = hv_fetch((HV*)SvRV(h), "dbi_set_err_method", 18, GV_ADDWARN); +@@ -4020,10 +4019,8 @@ XS(XS_DBI_dispatch) + err_meth_name = SvPV_nolen(*sem_svp); + } + +- /* XXX change to vsprintf into sv directly */ +- sprintf(intro,"%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name, +- SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information"); +- msg = sv_2mortal(newSVpv(intro,0)); ++ msg = sv_2mortal(newSVpvf("%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name, ++ SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information")); + if (SvOK(DBIc_ERRSTR(imp_xxh))) + sv_catsv(msg, DBIc_ERRSTR(imp_xxh)); + else +-- +2.52.0 + + +From f433dec6b8caf9e8d1df2d3428b9008b01a9da5f Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Thu, 28 May 2026 14:14:50 +0200 +Subject: [PATCH 2/2] Replacing `?` with `:p#` in `preparse ()` with more than + 9 `?` causes buffer overflow + +`:p1` is length 3, `?` just 1, but `:p1003` is length 6! +--- + DBI.xs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index 53d68b1..d7120a7 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4213,7 +4213,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + } + + /* XXX this allocation strategy won't work when we get to more advanced stuff */ +- new_stmt_sv = newSV(strlen(statement) * 3); ++ new_stmt_sv = newSV(strlen(statement) * 6 + 16); + sv_setpv(new_stmt_sv,""); + src = statement; + dest = SvPVX(new_stmt_sv); +-- +2.52.0 + diff --git a/SPECS/perl-DBI.spec b/SPECS/perl-DBI.spec index 7b7d93d..e39d12f 100644 --- a/SPECS/perl-DBI.spec +++ b/SPECS/perl-DBI.spec @@ -34,11 +34,13 @@ Name: perl-DBI Version: 1.641 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A database access API for perl License: GPL+ or Artistic URL: http://dbi.perl.org/ Source0: http://www.cpan.org/authors/id/T/TI/TIMB/DBI-%{version}.tar.gz +# RHEL-184974, CVE-2026-9698, Fix stack overflow and buffer overflow in DBI.xs +Patch0: DBI-1.641-Fix-CVE-2026-9698.patch BuildRequires: coreutils BuildRequires: findutils BuildRequires: gcc @@ -154,6 +156,7 @@ the use of existing DBI frameworks like DBIx::Class. %prep %setup -q -n DBI-%{version} +%patch -P0 -p1 for F in lib/DBD/Gofer.pm; do iconv -f ISO-8859-1 -t UTF-8 < "$F" > "${F}.utf8" touch -r "$F" "${F}.utf8" @@ -217,6 +220,10 @@ make test %endif %changelog +* Mon Jun 22 2026 Michal Josef Špaček - 1.641-5 +- Fix stack overflow and buffer overflow in DBI.xs (CVE-2026-9698) + Resolves: RHEL-184974 + * Mon Nov 22 2021 Jitka Plesnikova - 1.641-4 - BR: perl(blib), perl(FileHandle) for tests