CVE-2025-40908

Security Fix(es):

A vulnerability was found in TINITA YAML-LibYAML up to 0.902.x on Perl. It has been classified as problematic.CWE is classifying the issue as CWE-552. The product makes files or directories accessible to unauthorized actors, even though they should not be.This is going to have an impact on confidentiality.Upgrading to version 0.903.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-40908)

Kirill Siminov's "libyaml" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby.

Security Fix(es):

• yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kirill Siminov's "libyaml" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby.

Security Fix(es):

• yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

Kirill Siminov's "libyaml" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby.

Security Fix(es):

• yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kirill Siminov's "libyaml" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby.

Security Fix(es):

• yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified. (CVE-2025-40908)

These are all security issues fixed in the perl-YAML-LibYAML-0.904.0-2.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2025-40908 in the libyaml-libyaml-perl package for Root:Debian:11. Multiple fixed versions available.

This update for perl-YAML-LibYAML fixes the following issues:

• Updated to 0.904.0
• Dependency submission for the openQA stack

This update for perl-YAML-LibYAML fixes the following issues:

• CVE-2025-40908: YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified (bsc#1243902)

This update for perl-YAML-LibYAML fixes the following issues:

• CVE-2025-40908: YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified (bsc#1243902)

This update for perl-YAML-LibYAML fixes the following issues:

• CVE-2025-40908: YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified (bsc#1243902)

It was discovered that YAML-LibYAML incorrectly handled certain file names. An attacker could possibly use this issue to overwrite arbitrary files.