BSD Portsdatabases/p5-DBI -- multiple vulnerabilities
· CVE-2026-15392, CVE-2026-78030, CVE-2026-73193, CVE-2026-73194, CVE-2026-60081, CVE-2026-60082, CVE-2026-15043, CVE-2026-14380, CVE-2026-14740, CVE-2026-14739 · VuXML entry
DBI project reports: DBI 1.650, 1.651, 1.652, 1.653 and 1.654 fix the following issues: CVE-2026-88815: Fix DBI::sql_type_cast on IV/NV CVE-2026-88816: Fix FetchHashKeyName on IV/NV CVE-2026-78030: Fix arbitrary module and file loading via dbm_type/dbm_mldbm CVE-2026-15392: Tighten symlink outside of f_dir CVE-2026-73194: Force placeholder limit on :# and :p# too CVE-2026-73193: Limit statements to 292 Mb in …
Affected versions
- p5-DBI < 1.654
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/p5-DBI | 1.656 | fixed | |
| OpenBSD | databases/p5-DBI | 1.656 | out of range, by version | |
| NetBSD | databases/p5-DBI | 1.653 | not listed | |
| MidnightBSD | databases/p5-DBI | 1.656 | out of range, by version | |
| DragonFly | databases/p5-DBI | 1.647 | vulnerable since 2026-09-25 |