CVE-2012-1152

Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML ...

5.0 MediumFix available

CVE-2012-1152 is a medium vulnerability (CVSS 5.0) in Ingy Yaml\, published March 12, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. Fixed in libyaml-libyaml-perl 0.38-2.

What does this mean?

Severity: 5.0 MediumCVSS 2.0, NVD
Exploit chance: 2.43%EPSS, 84th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 0.38-2libyaml-libyaml-perl +4 more

Description

Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to the Load function, (2) YAML node to the load_node function, (3) YAML mapping to the load_mapping function, or (4) YAML sequence to the load_sequence function.

Exploit likelihood

2.43%Down 1.4 points since Feb 4, 2022

Affected products

ingy yaml\

Affected packages

Affected packages
Package	Affected	Fixed
`libyaml-libyaml-perl` Debian:12	before 0.38-2	0.38-2
`libyaml-libyaml-perl` Debian:13	before 0.38-2	0.38-2
`libyaml-libyaml-perl` Debian:14	before 0.38-2	0.38-2
`libyaml-libyaml-perl` Debian:6.0	before 0.33-1+squeeze1, plus listed versions 0.33-1	0.33-1+squeeze1
`perl-YAML-LibYAML` openSUSE:Tumbleweed From an advisory covering 4 CVEs	before 0.59-2.11	0.59-2.11