CVE-2014-4330: data_dumper_project data_dumper

Vulnerability summary

CVE-2014-4330 is a low (CVSS 2.1) vulnerability in data_dumper_project data_dumper. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 30-09-2014
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.