VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 16, 2020· Updated Aug 4, 2024

CVE-2020-14393

CVE-2020-14393

Description

Buffer overflow in perl-DBI <1.643 allows local attackers to cause out-of-bounds write via an overlong DBD class name, leading to denial of service or data corruption.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Buffer overflow in perl-DBI <1.643 allows local attackers to cause out-of-bounds write via an overlong DBD class name, leading to denial of service or data corruption.

Vulnerability

In perl-DBI versions prior to 1.643, the DBI.xs file contains a buffer overflow vulnerability. When a DBD class name string longer than 300 characters is supplied, an out-of-bounds write occurs. This affects all versions before 1.643. [1]

Exploitation

A local attacker with the ability to supply a crafted DBD class name (e.g., via a Perl script using DBI) can trigger the overflow. No special privileges are required beyond local access. The attacker provides a string exceeding 300 characters, causing the buffer overflow. [1]

Impact

Successful exploitation results in an out-of-bounds write, which can corrupt memory and lead to denial of service (crash) or potential integrity compromise of data. The attacker does not gain code execution from the described vulnerability, but availability and integrity are affected. [1]

Mitigation

Upgrade to perl-DBI version 1.643 or later, which contains the fix. Red Hat has marked this as WONTFIX for its affected products, meaning no official patch will be provided; users are advised to apply the upstream fix or mitigate by restricting local access. [1]

References
  1. Buffer overflow on an overlong DBD class name

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

30

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

6

News mentions

0

No linked articles in our index yet.