PT-2009-3304 · Perl+1 · Dbd::Pg+1

Published 2009-04-30 · Updated 2017-09-29 · CVE-2009-0663

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DBD::Pg module version 1.49

Description A heap-based buffer overflow issue exists in the DBD::Pg module for Perl, potentially allowing attackers to execute arbitrary code. This issue arises when unspecified input is provided to an application that utilizes the getline and pg getline functions to read database rows.

Recommendations For DBD::Pg module version 1.49, consider updating to a newer version that addresses this issue, as using the getline and pg getline functions with untrusted input may lead to exploitation. As a temporary workaround, restrict the use of these functions with untrusted data until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-0663

DSA-1780-1

RHSA-2009:0479

RHSA-2009:1067

RHSA-2009_0479

Affected Products

Dbd::Pg

Red Hat

References · 19

• http://security.debian.org/pool/updates/main/libd/libdbd-pg-perl/libdbd-pg-perl_1.49-2+etch1.diff.gz · Patch
• https://osv.dev/vulnerability/CVE-2009-0663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0663 · Security Note
• http://redhat.com/support/errata/RHSA-2009-1067.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0479.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-0663 · Vendor Advisory
• http://debian.org/security/2009/dsa-1780 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0663 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2009-1341 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50467 · Note
• https://access.redhat.com/errata/RHSA-2009:0479 · Note
• https://launchpad.net/bugs/cve/2009-0663 · Note
• https://access.redhat.com/security/cve/CVE-2009-0663 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9499 · Note