{"id":"CVE-2026-15392","aliases":["ALPINE-CVE-2026-15392","AZL-92424","BELL-CVE-2026-15392","DEBIAN-CVE-2026-15392","EUVD-2026-43727","GHSA-mh3j-xwf4-jrqw","MGASA-2026-0308","SUSE-SU-2026:22845-1","SUSE-SU-2026:22926-1","SUSE-SU-2026:3283-1","SUSE-SU-2026:3415-1","SUSE-SU-2026:3461-1","UBUNTU-CVE-2026-15392","openSUSE-SU-2026:11298-1","openSUSE-SU-2026:21412-1"],"status":"published","title":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location","description":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.\n\nThe complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.\n\nCallers of file-based drivers can read or write files outside of the data directory.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00196,"percentile":0.09429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-59"],"published":"2026-07-14T15:34:01Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl-DBI","fixed_in":["1.651-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-dbi","fixed_in":["1.651-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libdbi-perl","fixed_in":["1.643-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libdbi-perl","fixed_in":["1.652-2~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libdbi-perl","fixed_in":["1.651-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r4"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.647-r0"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.643-r3"},{"fixed":"1.651-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4+deb12u2"}]}],"versions":["1.643-4","1.643-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.652-2~deb13u1"}]}],"versions":["1.647-1","1.647-1+deb13u1","1.648-1","1.649-1","1.650-1","1.651-1","1.652-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-1"}]}],"versions":["1.647-1","1.648-1","1.649-1","1.650-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:9","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.mga9"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.642-150200.3.19.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.18.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.18.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-150600.12.18.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.628-5.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.628-5.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5","1.630-1ubuntu0.1~esm6","1.630-1ubuntu0.1~esm8","1.630-1ubuntu0.1~esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1","1.634-1ubuntu0.2+esm2","1.634-1ubuntu0.2+esm4","1.634-1ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3","1.640-1ubuntu0.3+esm1","1.640-1ubuntu0.3+esm3","1.640-1ubuntu0.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1","1.643-1ubuntu0.1+esm1","1.643-1ubuntu0.1+esm3","1.643-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-3build2","1.643-3build3","1.643-3ubuntu0.1","1.643-3ubuntu0.3","1.643-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3","1.643-4ubuntu0.1","1.643-4ubuntu0.3","1.643-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1build1","1.648-1","1.651-1","1.652-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libdbi-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1build1","1.647-1ubuntu0.26.04.1","1.647-1ubuntu0.26.04.3","1.647-1ubuntu0.26.04.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651.0-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-DBI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.647.0-160000.5.1"}]}],"bundled":4}],"products":[{"vendor":"hmbrand","product":"dbd::file"}],"references":[{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mh3j-xwf4-jrqw","tags":["vendor-advisory","advisory","report"]},{"url":"https://metacpan.org/release/HMBRAND/DBI-1.651/changes","tags":["release-notes","advisory","report"]},{"url":"https://github.com/perl5-dbi/dbi/commit/96d62dfe4528bf56fe13f413ed323d4252531728.patch","tags":["patch","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/14/15","tags":["web","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-15392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15392","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-15392","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15392.json","tags":["advisory"]},{"url":"https://github.com/perl5-dbi/dbi","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-15392","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0308.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35643","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/06/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/09/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/07/16","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/07/17","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/13","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/14","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/14/15","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622845-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271399","tags":["report"]},{"url":"https://bugzilla.suse.com/1271458","tags":["report"]},{"url":"https://bugzilla.suse.com/1271459","tags":["report"]},{"url":"https://bugzilla.suse.com/1271629","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60082","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622926-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263283-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271017","tags":["report"]},{"url":"https://bugzilla.suse.com/1271018","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14740","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263415-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263461-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-15392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15392","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41813967/","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-15392","title":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location","description":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.\n\nThe complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.\n\nCallers of file-based drivers can read or write files outside of the data directory.","status":"published","published":"2026-07-14T15:34:01.547Z","modified":"2026-07-15T14:01:34.76Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-43727","description":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.\n\nThe complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.\n\nCallers of file-based drivers can read or write files outside of the data directory.","status":"published","published":"2026-07-14T15:34:01Z","modified":"2026-07-15T14:01:34Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"nvd":[{"id":"CVE-2026-15392","description":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.\n\nThe complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.\n\nCallers of file-based drivers can read or write files outside of the data directory.","status":"published","published":"2026-07-14T16:16:45.827Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:12:29.114188Z"}],"osv":[{"id":"ALPINE-CVE-2026-15392","description":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.\n\nThe complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.\n\nCallers of file-based drivers can read or write files outside of the data directory.","status":"published","published":"2026-07-14T16:16:45.827Z","modified":"2026-10-01T02:17:49.191516209Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-15392","status":"published","published":"2026-07-17T06:02:58.325616Z","modified":"2026-07-24T07:15:06.389520407Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-15392","title":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location","description":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.\n\nThe complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.\n\nCallers of file-based drivers can read or write files outside of the data directory.","status":"published","published":"2026-07-14T15:34:01.547Z","modified":"2026-11-11T10:47:26.818365312Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2026-15392","description":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.  The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.  Callers of file-based drivers can read or write files outside of the data directory.","status":"published","published":"2026-07-14T16:16:45.827Z","modified":"2026-10-25T09:47:32.183300755Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"UBUNTU-CVE-2026-15392","description":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.","status":"published","published":"2026-07-14T16:16:00Z","modified":"2026-10-17T12:58:05.767816089Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"AZL-92424","title":"CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1","description":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.\n\nThe complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.\n\nCallers of file-based drivers can read or write files outside of the data directory.","status":"published","published":"2026-07-14T16:16:45Z","modified":"2026-08-28T17:56:24.135826Z","updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"MGASA-2026-0308","title":"Updated perl-DBI packages fix security vulnerabilities","description":"The updated packages fix several security issues.\n","status":"published","published":"2026-07-30T17:03:15Z","modified":"2026-07-30T17:20:27.407974876Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11298-1","title":"perl-DBI-1.651.0-1.1 on GA media","description":"These are all security issues fixed in the perl-DBI-1.651.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-17T00:00:00Z","modified":"2026-07-18T08:45:08.431935316Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21412-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads\n  and writes outside the configured data director (bsc#1271629).\n- CVE-2026-15043: `DBI:SQL:Nano` has incorrect predicate evaluation, which allows for bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-60081: `DBI:ProfileData` does not limit the path index in profile parser, which enables small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row,\n  which allows for a process crash (bsc#1271459).\n","status":"published","published":"2026-07-22T08:23:18Z","modified":"2026-07-24T18:24:26.386804707Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22845-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads\n  and writes outside the configured data director (bsc#1271629).\n- CVE-2026-15043: `DBI:SQL:Nano` has incorrect predicate evaluation, which allows for bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-60081: `DBI:ProfileData` does not limit the path index in profile parser, which enables small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row,\n  which allows for a process crash (bsc#1271459).\n","status":"published","published":"2026-07-22T08:18:52Z","modified":"2026-07-28T18:24:09.368561793Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22926-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads\n  and writes outside the configured data director (bsc#1271629).\n- CVE-2026-15043: `DBI:SQL:Nano` has incorrect predicate evaluation, which allows for bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-60081: `DBI:ProfileData` does not limit the path index in profile parser, which enables small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row,\n  which allows for a process crash (bsc#1271459).\n","status":"published","published":"2026-07-22T08:18:52Z","modified":"2026-07-29T18:24:20.797864853Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3283-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues\n\n- CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code\n  execution (bsc#1271018).\n- CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash\n  (bsc#1271017).\n- CVE-2026-15043: incorrect predicate evaluation in `DBI:SQL:Nano` can lead to bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in `DBD::File`\n  allows for arbitrary file reads and writes (bsc#1271629).\n- CVE-2026-60081: no limiting of the path index in profile parser of `DBI:ProfileData` can enable small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row\n  can lead to a process crash (bsc#1271459).\n","status":"published","published":"2026-07-27T13:45:29Z","modified":"2026-07-28T10:00:10.500404336Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3415-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues\n\n- CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code\n  execution (bsc#1271018).\n- CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash\n  (bsc#1271017).\n- CVE-2026-15043: incorrect predicate evaluation in `DBI:SQL:Nano` can lead to bypass of file-backed filters\n  (bsc#1271399).  \n- CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in `DBD::File`\n  allows for arbitrary file reads and writes (bsc#1271629).\n- CVE-2026-60081: no limiting of the path index in profile parser of `DBI:ProfileData` can enable small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row\n  can lead to a process crash (bsc#1271459).\n","status":"published","published":"2026-07-30T06:54:43Z","modified":"2026-07-30T17:15:11.423115226Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3461-1","title":"Security update for perl-DBI","description":"This update for perl-DBI fixes the following issues:\n\n- CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code\n  execution (bsc#1271018).\n- CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash\n  (bsc#1271017).\n- CVE-2026-15043: incorrect predicate evaluation in `DBI:SQL:Nano` can lead to bypass of file-backed filters\n  (bsc#1271399).\n- CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in `DBD::File`\n  allows for arbitrary file reads and writes (bsc#1271629).\n- CVE-2026-60081: no limiting of the path index in profile parser of `DBI:ProfileData` can enable small-file\n  memory-amplification DoS (bsc#1271458).\n- CVE-2026-60082: out-of-bounds access in `_set_fbav` when a statement handle has zero fields but a non-empty row\n  can lead to a process crash (bsc#1271459).\n\nChanges for perl-DBI:\n\n- missing method dependency in the path-containment guard can cause security check failures and functional regressions\n  when handling table symlinks (bsc#1271822).\n","status":"published","published":"2026-08-03T12:13:48Z","modified":"2026-08-04T11:45:08.868420805Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}