[ MDVSA-2009:344 ] perl-DBD-Pg

[dude67]

_______________________________________________________________________

Package : perl-DBD-Pg
Date : December 28, 2009
Affected: 2008.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities was discovered and corrected in perl-DBD-Pg:

Heap-based buffer overflow in the DBD::Pg module for Perl might allow
context-dependent attackers to execute arbitrary code via unspecified
input to an application that uses the getline and pg_getline functions
to read database rows.

Memory leak in the dequote_bytea function in quote.c in the DBD::Pg
(aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows
context-dependent attackers to cause a denial of service (memory
consumption) by fetching data with BYTEA columns (CVE-2009-1341).

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.

This update provides a fix for these vulnerabilities.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0663
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1341
_______________________________________________________________________