CVE-2014-4330 The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference...
LowCVSS 2.1
EPSS 0.55%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/perl(Debian:12) | < 5.20.1-1 | 5.20.1-1 |
| debian/perl(Debian:13) | < 5.20.1-1 | 5.20.1-1 |
| debian/perl(Debian:14) | < 5.20.1-1 | 5.20.1-1 |
| perl | <= 5.20.1 | No fix listed |
| data dumper project data dumper | <= 2.151 | No fix listed |
References
- Debian Security Tracker CVE-2014-4330 vendor-advisory
- advisories.mageia.org
- FEDORA-2014-11453 vendor-advisory
- packetstormsecurity.com exploit
- 20140925 LSE Leading Security Experts GmbH - LSE-2014-06-10 - Perl CORE - Deep Recursion Stack Overflow exploit mailing-list
- [oss-security] 20140925 LSE Leading Security Experts GmbH - LSE-2014-06-10 - Perl CORE - Deep Recursion Stack Overflow exploit mailing-list
- 61441 third-party-advisory
- 61961 third-party-advisory
- MDVSA-2015:136 vendor-advisory
- [perl.perl5.porters] 20140918 fix for CVE-2014-4330 present in blead mailing-list
- 20140925 LSE Leading Security Experts GmbH - LSE-2014-06-10 - Perl CORE - Deep Recursion Stack Overflow mailing-list
- 70142 vdb-entry
- USN-2916-1 vendor-advisory
- perl-cve20144330-dos(96216) vdb-entry
- h20566.www2.hpe.com
- metacpan.org
- www.lsexperts.de exploit
- bugs.debian.org issue-tracking