Description
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to the Load function, (2) YAML node to the load_node function, (3) YAML mapping to the load_mapping function, or (4) YAML sequence to the load_sequence function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libyaml-libyaml-perl | 0.38-2 | — |
| Debian 13 | libyaml-libyaml-perl | 0.38-2 | — |
| Debian 12 | libyaml-libyaml-perl | 0.38-2 | — |
| Debian 6.0 | libyaml-libyaml-perl | 0.33-1+squeeze1 | DSA-2432-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-YAML-LibYAML | 0.59-2.11 | openSUSE-SU-2024:10520-1 |
Advisories 2
- DSA-2432-1 libyaml-libyaml-perl - format string vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10520-1 perl-YAML-LibYAML-0.59-2.11 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20120309 Re: CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws mailing-list
- openSUSE-SU-2012:1000 vendor-advisory
- FEDORA-2012-4997 vendor-advisory
- 48317 third-party-advisory
- FEDORA-2012-5035 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661548
- openSUSE-SU-2015:0319 vendor-advisory
- 52381 vdb-entry
- yaml-load-format-string(73856) vdb-entry
- 50277 third-party-advisory
- [oss-security] 20120309 CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws mailing-list
- FEDORA-2012-4871 vendor-advisory
- https://rt.cpan.org/Public/Bug/Display.html?id=75365
- https://rt.cpan.org/Public/Bug/Display.html?id=46507
- DSA-2432 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=801738