CVE catalog

CVE-2014-10402

libdbi-perl: CVE-2014-10402

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.49% · Oct 25, 2026

An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibdbi-perlsid1.656-1fixed
Debianlibdbi-perlforky1.656-1fixed
Debianlibdbi-perltrixie1.652-2~deb13u1fixed
Debianlibdbi-perltrixie-security1.652-2~deb13u1fixed
Debianlibdbi-perlbookworm1.643-4+deb12u1fixed
Debianlibdbi-perlbookworm-security1.643-4+deb12u3fixed
Ubuntulibdbi-perlpro1.633-1vulnerable
Ubuntulibdbi-perlpro1.634-1vulnerable
Ubuntulibdbi-perlpro1.634-1build1vulnerable
Ubuntulibdbi-perlpro1.634-1ubuntu0.1vulnerable
Ubuntulibdbi-perlpro1.634-1ubuntu0.2vulnerable
Ubuntulibdbi-perlpro1.634-1ubuntu0.2+esm1fixed
Ubuntulibdbi-perl18.041.637-1vulnerable
Ubuntulibdbi-perl18.041.639-1vulnerable
Ubuntulibdbi-perl18.041.640-1vulnerable
Ubuntulibdbi-perl18.041.640-1ubuntu0.1vulnerable
Ubuntulibdbi-perl18.041.640-1ubuntu0.2vulnerable
Ubuntulibdbi-perl18.041.640-1ubuntu0.3fixed
Ubuntulibdbi-perl20.041.642-1vulnerable
Ubuntulibdbi-perl20.041.642-1build1vulnerable
Ubuntulibdbi-perl20.041.643-1vulnerable
Ubuntulibdbi-perl20.041.643-1ubuntu0.1fixed
Alpineperl-dbi3.151.643-r0fixed
Alpineperl-dbi3.161.643-r0fixed
Alpineperl-dbi3.171.643-r0fixed
Alpineperl-dbi3.181.643-r0fixed
Alpineperl-dbi3.191.643-r0fixed
Alpineperl-dbi3.201.643-r0fixed
Alpineperl-dbi3.211.643-r0fixed
Alpineperl-dbi3.221.643-r0fixed
Alpineperl-dbi3.231.643-r0fixed
Alpineperl-dbi3.241.643-r0fixed
Ubuntulibdbi-perlpro1.633-1vulnerable
Ubuntulibdbi-perlpro1.634-1vulnerable
Ubuntulibdbi-perlpro1.634-1build1vulnerable
Ubuntulibdbi-perlpro1.634-1ubuntu0.1vulnerable
Ubuntulibdbi-perlpro1.634-1ubuntu0.2vulnerable
Ubuntulibdbi-perlpro1.634-1ubuntu0.2+esm1fixed
Ubuntulibdbi-perl18.041.637-1vulnerable
Ubuntulibdbi-perl18.041.639-1vulnerable
Ubuntulibdbi-perl18.041.640-1vulnerable
Ubuntulibdbi-perl18.041.640-1ubuntu0.1vulnerable
Ubuntulibdbi-perl18.041.640-1ubuntu0.2vulnerable
Ubuntulibdbi-perl18.041.640-1ubuntu0.3fixed
Ubuntulibdbi-perl20.041.642-1vulnerable
Ubuntulibdbi-perl20.041.642-1build1vulnerable
Ubuntulibdbi-perl20.041.643-1vulnerable
Ubuntulibdbi-perl20.041.643-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibdbi-perlsourcesid1.643-3not yet assignedNot reported[972180]
Debianlibdbi-perlsourceforky1.643-3not yet assignedNot reported[972180]
Debianlibdbi-perlsourcetrixie1.643-3not yet assignedNot reported[972180]
Debianlibdbi-perlsourcebookworm1.643-3not yet assignedNot reported[972180]
Ubuntulibdbi-perldebpro1.634-1ubuntu0.2+esm1Not reportedUBUNTU-CVE-2014-10402Not reported
Ubuntulibdbi-perldeb18.041.640-1ubuntu0.3Not reportedUBUNTU-CVE-2014-10402Not reported
Ubuntulibdbi-perldeb20.041.643-1ubuntu0.1Not reportedUBUNTU-CVE-2014-10402Not reported
Alpineperl-dbiapk3.151.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Alpineperl-dbiapk3.161.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Alpineperl-dbiapk3.171.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Alpineperl-dbiapk3.181.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Alpineperl-dbiapk3.191.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Alpineperl-dbiapk3.201.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Alpineperl-dbiapk3.211.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Alpineperl-dbiapk3.221.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Alpineperl-dbiapk3.231.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Alpineperl-dbiapk3.241.643-r0Not reportedALPINE-CVE-2014-10402Not reported
Ubuntulibdbi-perldebpro1.634-1ubuntu0.2+esm1Not reportedUSN-5030-2Not reported
Ubuntulibdbi-perldeb18.041.640-1ubuntu0.3Not reportedUSN-5030-1Not reported
Ubuntulibdbi-perldeb20.041.643-1ubuntu0.1Not reportedUSN-5030-1Not reported

[Debian bug #972180]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libdbi-perl]Unknown
    Details (4)

    • 1.643-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.643-3

      dsa · libdbi-perl · debian · bookworm; dsa · libdbi-perl · debian · 12

    • 1.643-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.643-3

      dsa · libdbi-perl · debian · bookworm; dsa · libdbi-perl · debian · 12

    • 1.643-4+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.643-3

      dsa · libdbi-perl · debian · bookworm; dsa · libdbi-perl · debian · 12

    • 1.643-4+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.643-3

      dsa · libdbi-perl · debian · bookworm; dsa · libdbi-perl · debian · 12

[Debian 13 (Trixie)]

  • [libdbi-perl]Unknown
    Details (5)

    • 1.647-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.643-3

      dsa · libdbi-perl · debian · 13

    • 1.647-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.643-3

      dsa · libdbi-perl · debian · 13

    • 1.647-1+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.643-3

      dsa · libdbi-perl · debian · 13

    • 1.652-2~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.643-3

      dsa · libdbi-perl · debian · 13

    • 1.652-2~deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.643-3

      dsa · libdbi-perl · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]