YAML::Syck vulnerabilities

In YAML::Syck for Perl before version 1.47, an out-of-bounds read vulnerability exists in the syck_base64dec function. It uses a signed char index to access the b64_xtable array, causing reads before the table when bytes >= 0x80 are encountered. The vulnerability is triggered by default Load or LoadFile calls on untrusted YAML documents containing a !!binary scalar with a high-bit byte.

The YAML::Syck library versions up to 1.36 for Perl contains several potential security vulnerabilities, including a high-severity heap buffer overflow in the YAML emitter. The overflow occurs when class names exceed the initial 512-byte allocation.

A vulnerability in YAML::Syck for Perl before version 1.47 allows an out-of-bounds read via an unbounded newline scan in the newline_len function. The issue occurs during block-scalar lexing at a document boundary, where the scan runs one byte past the heap lexer buffer.

A heap use-after-free vulnerability exists in YAML::Syck for Perl before version 1.47. The issue occurs when an anchor name is reused as a key in the anchors table in syck_hdlr_add_anchor, leading to reading freed heap memory.

In YAML::Syck for Perl before version 1.47, a use-after-free and double-free vulnerability exists when an anchor node is freed while still on the parser value stack. This causes a second free and interpreter crash.