DEBIAN-CVE-2019-25777
- Source
- https://security-tracker.debian.org/tracker/CVE-2019-25777
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-25777.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2019-25777
- Upstream
- CVE-2019-25777
- Published
- 2026-10-05T07:16:29Z
- Modified
- 2026-10-06T05:00:04Z
- Summary
- [none]
- Details
-
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.
- References
Affected packages
Debian:12 / libyaml-perl
Package
- Name
- libyaml-perl
- Purl
- pkg:deb/debian/libyaml-perl?arch=source&distro=bookworm
Debian:13 / libyaml-perl
Package
- Name
- libyaml-perl
- Purl
- pkg:deb/debian/libyaml-perl?arch=source&distro=trixie
Debian:14 / libyaml-perl
Package
- Name
- libyaml-perl
- Purl
- pkg:deb/debian/libyaml-perl?arch=source&distro=forky