https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:37:00 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2019-25777 <p>YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.</p> <p>A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML&#39;s own load options.</p> <p>A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.</p> <p>YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.</p> <p>A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML&#39;s own load options.</p> <p>A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2019-25777 https://vulnerability.circl.lu/vuln/ghsa-38xx-2hm6-vh7q <p>YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.</p> <p>A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML&#39;s own load options.</p> <p>A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.</p> <p>YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.</p> <p>A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML&#39;s own load options.</p> <p>A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.</p> https://vulnerability.circl.lu/vuln/ghsa-38xx-2hm6-vh7q https://vulnerability.circl.lu/vuln/ubuntu-cve-2019-25777 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libyaml-perl, Ubuntu:18.04:LTS: libyaml-perl, Ubuntu:20.04:LTS: libyaml-perl, Ubuntu:22.04:LTS: libyaml-perl, Ubuntu:24.04:LTS: libyaml-perl, Ubuntu:26.04:LTS: libyaml-perl</p> <p>(YAML versions before 1.27_001 for Perl allow a loaded perl/glob docume ...)</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libyaml-perl, Ubuntu:18.04:LTS: libyaml-perl, Ubuntu:20.04:LTS: libyaml-perl, Ubuntu:22.04:LTS: libyaml-perl, Ubuntu:24.04:LTS: libyaml-perl, Ubuntu:26.04:LTS: libyaml-perl</p> <p>(YAML versions before 1.27_001 for Perl allow a loaded perl/glob docume ...)</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2019-25777