CVE-2012-1152 Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial....
MediumCVSS 5.0
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to the Load function, (2) YAML node to the load_node function, (3) YAML mapping to the load_mapping function, or (4) YAML sequence to the load_sequence function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libyaml-libyaml-perl(Debian:12) | < 0.38-2 | 0.38-2 |
| debian/libyaml-libyaml-perl(Debian:13) | < 0.38-2 | 0.38-2 |
| debian/libyaml-libyaml-perl(Debian:14) | < 0.38-2 | 0.38-2 |
| ingy yamllibyaml | = 0.38 | No fix listed |
References
- Debian Security Tracker CVE-2012-1152 vendor-advisory
- bugs.debian.org
- FEDORA-2012-4997 vendor-advisory
- FEDORA-2012-5035 vendor-advisory
- FEDORA-2012-4871 vendor-advisory
- openSUSE-SU-2012:1000 vendor-advisory
- openSUSE-SU-2015:0319 vendor-advisory
- 48317 third-party-advisory vendor-advisory
- 50277 third-party-advisory
- DSA-2432 vendor-advisory
- [oss-security] 20120309 CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws mailing-list
- [oss-security] 20120309 Re: CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws mailing-list
- 52381 vdb-entry
- bugzilla.redhat.com
- yaml-load-format-string(73856) vdb-entry
- rt.cpan.org
- rt.cpan.org
- bugs.debian.org issue-tracking