The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-661790 advisory.

    [1.643-9.5]
    - Use Module::Load for safer package loading in DBI::Profile       (CVE-2026-19546)       Related: RHEL-236831

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1822:04 advisory.

    * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile     attribute (CVE-2026-19546)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_66179 advisory.

    * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile     attribute (CVE-2026-19546)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789485312 advisory.

  - A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For     a detailed Statement, Description and Mitigation please reffer to the original     https://access.redhat.com/security/cve/cve-2026-19546. (CVE-2026-19546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-658870 advisory.

    [1.643-26.4]
    - Fix CVE-2026-19546: incomplete fix for CVE-2026-14380 in       DBI::Profile       Resolves: RHEL-236830

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_65887 advisory.

    * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile     attribute (CVE-2026-19546)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl-DBI packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.

    For a detailed Statement, Description and Mitigation please reffer to the original     https://access.redhat.com/security/cve/cve-2026-19546.(CVE-2026-19546)

    DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.

    When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and     arguments, and interpolates the package part in a string eval with no validation of the package name.

    Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution,     including calls to run system commands.

    The Profile attribute can be set from three different sources that can carry untrusted data: the     DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause     dbi:Driver(Profile=SPEC):db.

    An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote     position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile     attribute, letting a client execute code on the broker host.(CVE-2026-14380)

    DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer     wraparound in the output buffer size computed by preparse.

    preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes     per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits     wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo     2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no     capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder     limit does not bound this path, which is reached by ordinary non-placeholder content.

    Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-     of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap     there needs a statement of about 2.3 exabytes.(CVE-2026-73193)

    DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL     comment.

    The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the     deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault     on memory-hardened builds and nondeterministic newline retention on normal builds.(CVE-2026-14740)

    DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder     that sets the binder counter in preparse.

    preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The     ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check,     so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi     wraps). Each following '?' then expands through `sprintf(start, ':p%d', idx++)` to ':p-2147483648', 14     bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the     counter against 99,999, which a negative counter passes.

    Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds     write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return     styles compare the parsed number against the expected sequence and error out, and are     unaffected.(CVE-2026-73194)

Tenable has extracted the preceding description block directly from the EulerOS perl-DBI security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:66179 advisory.

    * DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile     attribute (CVE-2026-19546)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
344565	Oracle Linux 9 : ELSA-2026-66179-0: / perl-DBI (ELSA-2026-661790)	Nessus	Oracle Linux Local Security Checks	2026/9/10	2026/9/11	high
345658	MiracleLinux 9 : perl-DBI-1.643-9.el9_8.5 (AXSA:2026-1822:04)	Nessus	Miracle Linux Local Security Checks	2026/9/14	2026/9/18	high
356594	Rocky Linux 9 [CIQ] Security Update: perl-DBI / perl-DBI-debuginfo / perl-DBI-debugsource (crlsa-2026_66179)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
360327	Rocky Linux 9.6 [TuxCare] Security Update: perl-DBI (ALMALINUX9.6:CLSA-2026:1789485312)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
344605	Oracle Linux 10 : ELSA-2026-65887-0: / perl-DBI (ELSA-2026-658870)	Nessus	Oracle Linux Local Security Checks	2026/9/10	2026/9/11	high
354481	Rocky Linux 10.2 [CIQ] Security Update: perl-DBI / perl-DBI-debuginfo / perl-DBI-debugsource (crlsa-2026_65887)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
376737	EulerOS 2.0 SP12 : perl-DBI (EulerOS-SA-2026-4514)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	critical
376767	EulerOS 2.0 SP12 : perl-DBI (EulerOS-SA-2026-4437)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	critical
344511	AlmaLinux 9 : perl-DBI (ALSA-2026:66179)	Nessus	Alma Linux Local Security Checks	2026/9/10	2026/9/11	high

检测

插件搜索

high

high

high

high

high

high

critical

critical

high