CVE-2020-14392 — Untrusted Pointer Dereference in Database Interface

CWE-822 — Untrusted Pointer DereferenceCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer9 documents8 sources
Severity
5.5MEDIUMNVD
EPSS
0.2%
top 63.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Perl Database InterfaceCanonical Ubuntu LinuxDebian Linux+2 more
Timeline
PublishedSep 16
Latest updateMay 24

Description

An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶NVDopensuse/leap15.1, 15.2+1

Also affects: Debian Linux 9.0, Fedora 31, Ubuntu Linux 12.04, 14.04, 16.04, 18.04

🔴Vulnerability Details

3
GHSA
GHSA-xm43-qc4p-9f7j: An untrusted pointer dereference flaw was found in Perl-DBI < 1↗2022-05-24
▶
OSV
CVE-2020-14392: An untrusted pointer dereference flaw was found in Perl-DBI < 1↗2020-09-16
▶
CVEList
CVE-2020-14392: An untrusted pointer dereference flaw was found in Perl-DBI < 1↗2020-09-16
▶

📋Vendor Advisories

3
Ubuntu
Perl DBI module vulnerability↗2020-09-16
▶
Debian
CVE-2020-14392: libdbi-perl - An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local att...↗2020
▶
Red Hat
perl-dbi: Memory corruption in XS functions when Perl stack is reallocated↗2019-07-31
▶

💬Community

2
Bugzilla
CVE-2020-14392 perl-DBI: Memory corruption in XS functions when Perl stack is reallocated [fedora-all]↗2020-09-09
▶
Bugzilla
CVE-2020-14392 perl-dbi: Memory corruption in XS functions when Perl stack is reallocated↗2020-09-09
▶
CVE-2020-14392 — Untrusted Pointer Dereference | cvebase