Advisories » MGASA-2014-0407

Updated perl-Data-Dumper package fixes CVE-2014-4330

Publication date: 09 Oct 2014
Modification date: 09 Oct 2014
Type: security
Affected Mageia releases : 3 , 4
CVE: CVE-2014-4330

Description

Updated perl-Data-Dumper package fixes security vulnerability:

The Dumper method in Data::Dumper before 2.154, allows context-dependent
attackers to cause a denial of service (stack consumption and crash) via an
Array-Reference with many nested Array-References, which triggers a large
number of recursive calls to the DD_dump function (CVE-2014-4330).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=14198
• https://lists.fedoraproject.org/pipermail/package-announce/2014-September/139441.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4330

SRPMS

4/core

• perl-Data-Dumper-2.154.0-1.mga4

3/core

• perl-Data-Dumper-2.154.0-1.mga3