Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2012-1152 Details

Description

Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to the Load function, (2) YAML node to the load_node function, (3) YAML mapping to the load_mapping function, or (4) YAML sequence to the load_sequence function.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661548	CVE
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077004.html	CVE
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077023.html	CVE
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077782.html	CVE
http://lists.opensuse.org/opensuse-updates/2012-08/msg00029.html	CVE
http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html	CVE
https://bugzilla.redhat.com/show_bug.cgi?id=801738	CVE
http://secunia.com/advisories/48317	CVE	Vendor Advisory
http://secunia.com/advisories/50277	CVE
https://exchange.xforce.ibmcloud.com/vulnerabilities/73856	CVE
https://rt.cpan.org/Public/Bug/Display.html?id=46507	CVE
https://rt.cpan.org/Public/Bug/Display.html?id=75365	CVE
http://www.debian.org/security/2012/dsa-2432	CVE
http://www.openwall.com/lists/oss-security/2012/03/09/6	CVE
http://www.openwall.com/lists/oss-security/2012/03/10/4	CVE
http://www.securityfocus.com/bid/52381	CVE
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661548	[email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077004.html	[email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077023.html	[email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077782.html	[email protected]
http://lists.opensuse.org/opensuse-updates/2012-08/msg00029.html	[email protected]
http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html	[email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=801738	[email protected]
http://secunia.com/advisories/48317	[email protected]	Vendor Advisory
http://secunia.com/advisories/50277	[email protected]
https://exchange.xforce.ibmcloud.com/vulnerabilities/73856	[email protected]
https://rt.cpan.org/Public/Bug/Display.html?id=46507	[email protected]
https://rt.cpan.org/Public/Bug/Display.html?id=75365	[email protected]
http://www.debian.org/security/2012/dsa-2432	[email protected]
http://www.openwall.com/lists/oss-security/2012/03/09/6	[email protected]
http://www.openwall.com/lists/oss-security/2012/03/10/4	[email protected]
http://www.securityfocus.com/bid/52381	[email protected]

see all 32 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-134	Use of Externally-Controlled Format String	[email protected]

Affected Products

Product	Versions
ingy yaml::libyaml	0.38
CPE cpe:2.3:a:ingy:yaml::libyaml:0.38:::::::* Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 29, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Aug 29, 2017	CVE Modified	[email protected]
Mar 18, 2015	CVE Modified	[email protected]
Sep 10, 2012	Initial Analysis	[email protected]