CVE-2020-14392: Buffer Overflow
A flaw was found in perl-dbi before version 1.643. Macro ST() returns pointer to Perl stack. Other Perl functions which use Perl stack (e.g. eval) may reallocate Perl stack and therefore pointer returned by ST() macro is invalid which may lead to memory corruption.
Upstream patch:
https://github.com/perl5-dbi/dbi/commit/ea99b6aafb437db53c28fd40d5eafbe119cd66e1
Other sources
An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbddblogin6sv() could cause memory corruption, affecting the service's availability.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-14392?
CVE-2020-14392 is a vulnerability found in Perl-DBI < 1.643 that allows a local attacker to cause memory corruption, affecting the service's availability.
How severe is CVE-2020-14392?
CVE-2020-14392 has a severity score of 5.5, which is classified as medium severity.
Which software versions are affected by CVE-2020-14392?
Perl-DBI versions earlier than 1.643 are affected by CVE-2020-14392.
How can a local attacker exploit CVE-2020-14392?
A local attacker can exploit CVE-2020-14392 by manipulating calls to dbd_db_login6_sv() to cause memory corruption.
Are there any remedies available for CVE-2020-14392?
Yes, the Debian package libdbi-perl versions 1.642-1+deb10u2, 1.643-3, and 1.643-4 provide remedies for CVE-2020-14392.