Your message dated Tue, 10 Nov 2026 21:47:07 +0000
with message-id <[email protected]>
and subject line Bug#1151666: fixed in libdbi-perl 1.656-1~deb13u1
has caused the Debian Bug report #1151666,
regarding libdbi-perl: CVE-2026-108518 CVE-2026-111879
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151666: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151666
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libdbi-perl
Version: 1.655-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerabilities were published for libdbi-perl.
CVE-2026-108518[0]:
| DBI versions before 1.656 for Perl crash via type confusion in
| dbi_profile when a database handle is destroyed under a Profile Path
| with an {attr} element. An {attr} element names a database handle
| attribute, which dbi_profile reads from the handle's inner hash. It
| expects the inner handle as a reference and dereferences it, but a
| handle that is being destroyed hands back the inner hash itself, so
| the dereference yields the hash's bucket array. A type check on that
| pointer usually fails and the call goes unprofiled. When the memory
| it addresses passes the check, the attribute lookup dereferences a
| NULL or invalid pointer and the process dies on SIGSEGV. The Path
| is set by the application, by the Profile handle attribute, or by
| the DBI_PROFILE environment variable, so
| `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.
CVE-2026-111879[1]:
| DBI versions before 1.656 for Perl hang on a later open of a
| DBD::DBM table because a failed open_data does not release the
| table's lock. open_data creates the table's lock file and takes an
| exclusive flock on it for a CREATE, before the checks that can
| croak: a dbm_mldbm value that is not a module name, a failing tie,
| or a missing data file. The croak unwinds before the table object is
| blessed, so nothing releases the lock, and the meta data holding the
| open descriptor stays cached on the database handle. The dbm_mldbm
| and dbm_type values come from the DSN or the connect attributes, so
| a caller that chooses the serializer or the storage backend can
| trigger the failure. The flock has no timeout, so a later open of
| that table (even through a separate database handle) blocks for as
| long as the handle holding the stale lock lives, in the same process
| or any other.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-108518
https://www.cve.org/CVERecord?id=CVE-2026-108518
https://lists.security.metacpan.org/cve-announce/msg/44513047/
[1] https://security-tracker.debian.org/tracker/CVE-2026-111879
https://www.cve.org/CVERecord?id=CVE-2026-111879
https://lists.security.metacpan.org/cve-announce/msg/44513053/
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libdbi-perl
Source-Version: 1.656-1~deb13u1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libdbi-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated libdbi-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 09 Nov 2026 20:37:27 +0100
Source: libdbi-perl
Architecture: source
Version: 1.656-1~deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1149042 1151666
Changes:
libdbi-perl (1.656-1~deb13u1) trixie; urgency=medium
.
* Team upload.
* Rebuild for trixie
.
libdbi-perl (1.656-1) unstable; urgency=medium
.
* Import upstream version 1.656.
+ Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann)
+ Fix lock file not removed when DBD::DBM check for bad serializer class
fails. (CVE-2026-111879)
Closes: #1151666
.
libdbi-perl (1.655-1) unstable; urgency=medium
.
* Import upstream version 1.655.
.
libdbi-perl (1.654-1) unstable; urgency=medium
.
* Import upstream version 1.654.
- Fix DBI::sql_type_cast on IV/NV (CVE-2026-88815)
- Fix FetchHashKeyName on IV/NV (CVE-2026-88816)
Closes: #1149042
.
libdbi-perl (1.653-1) unstable; urgency=medium
.
* Import upstream version 1.653.
- Fix arbitrary module and file loading via dbm_type/dbm_mldbm
(CVE-2026-78030)
- Tighten symlink outside of f_dir (CVE-2026-15392) check
* Drop 0001-Fix-test-for-32bit-perl-report-in-PR-189.patch which was
taken from upstream Git.
Checksums-Sha1:
6a5aa40b07e107dbb6a59d9afb13a5fcf73ee15c 2373 libdbi-perl_1.656-1~deb13u1.dsc
a43bb41a94ece45a854518ab6dfeea18a40b4965 15156
libdbi-perl_1.656-1~deb13u1.debian.tar.xz
Checksums-Sha256:
32362ba29cb07b69bd992758a15e64cedd9fa56772848b335cc2fa8ec504b710 2373
libdbi-perl_1.656-1~deb13u1.dsc
24bfbc07ad615a8a4bcee67967b745f386ff4271f743e838c306276fc5e6f942 15156
libdbi-perl_1.656-1~deb13u1.debian.tar.xz
Files:
f7e703434cb87bf2ab526a022ca7fce8 2373 perl optional
libdbi-perl_1.656-1~deb13u1.dsc
d92b90952f6a4327b42e780915bd6905 15156 perl optional
libdbi-perl_1.656-1~deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmryL5dfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EhOwP/RjwXNJeHU96OVlIl+GyGgqMOSlymH4I
unL0tsVXMsrQzK8HxbNtNRWfeYBVf5WZnmK1R1kWOzjL+k4A43hAZG7Vb7QYuSba
XfYW14vRPiuVFnXU4gO3rasrfK9/mhdncD4ZgzC4+xceEth+/3/XEbUqI4S0eoyU
+bgnjO4Cd1x3BVA26uHuqbUQe1lBvNbAwLZVogYPgpGfSoyJpy5vhGKWp+nkSlrt
CVbEIgoDksF04CqHAAwzgU0jaDpFx9950lZqX+wgivEOr6apTbpn5fqsNX75B5Nb
SWvZwjAvWcokIgUC5TQVCyrSXsODZWVj8cTZBG27RLssRdRZh4TAIGE5PeII8Q1I
2qSlL833rvrUj+YiIstdfA/rbMWLtMEcmAL5NDFaaquaT+ksg1joJKrOw3mBLLab
rz6CeWqldEijflPja6nxM0fVAmVb2wPdRBAq1VSNZRcNKLX4wTlAC9mWuoO/OVA1
V8RaPAGW9S/A5hil3J2AuzS4XiKrGbuIJ2sLOvYYS1NeU+lLja+i/XFv3qoejlGH
UAuDD9tDYwNXD9EVGXeBlNxe+c4eXKrzwZqZT6AtZ28XfUIgA18Ilq5182tCN2rg
Qto/Lfho73eba+XA1kgO8MtMr3DtA/di9UsNTIYrhh7TKcXBKwsg5NdRxZLWfC6E
3VpaVpyfFnzi
=joBJ
-----END PGP SIGNATURE-----
pgpn_mdV0r3uz.pgp
Description: PGP signature
--- End Message ---
