CVE-2019-25777 YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

CVE-2019-25777: Improper Control of Dynamically-Identified Variables

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

MGASA-2020-0275 Updated perl-YAML packages fix security vulnerability

Updated perl-YAML package fixes security vulnerability: This update enforces that $LoadCode must be enabled to use the feature of evaluating typeglobs, because with the typeglob feature you would be able to set the variable $YAML::LoadCode from a YAML file, and that would be a security issue. The...

Updated perl-YAML packages fix security vulnerability

Updated perl-YAML package fixes security vulnerability: This update enforces that $LoadCode must be enabled to use the feature of evaluating typeglobs, because with the typeglob feature you would be able to set the variable $YAML::LoadCode from a YAML file, and that would be a security issue. The...

PT-2020-22802

Name of the Vulnerable Software and Affected Versions perl-YAML versions prior to 1.30 Description The issue arises from the ability to evaluate typeglobs, which could allow setting the variable $YAML::LoadCode from a YAML file, posing a security risk. This is mitigated by enforcing that $LoadCod...

PT-2020-22327

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state includes functions such as r uleb128, parse class, and dex loadcode. No information i...

UBUNTU-CVE-2017-6387

The dexloadcode function in libr/bin/p/bindex.c in radare2 1.2.1 allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted DEX file...

PT-2017-17030

Name of the Vulnerable Software and Affected Versions radare2 version 1.2.1 Description The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds read and application crash, via a crafted DEX file. This is due to a problem in the dex loadcode function...

radare2 denial of service vulnerability (CNVD-2017-02720)

radare2 is a set of libraries and tools for working with binary files. A security vulnerability exists in the 'dexloadcode' function in the libr/bin/p/bindex.c file in radare2 version 1.2.1. A remote attacker can exploit this vulnerability to cause a denial of service out-of-bounds read and...