Todd Rinaldo

YAML::Syck for Perl has multiple security issues, including a high-severity heap buffer overflow in the YAML emitter. This overflow happens when class names are longer than the initial 512-byte allocation. The base64 decoder may read beyond the buffer's end when encountering trailing newlines. The `strtok` function modifies `n->type id` directly, potentially corrupting shared node data. Additionally, a memory leak occurs in the `syck hdlr add anchor` function when a node already has an anchor, leaking the incoming anchor string `a` upon early return. The issue affects the YAML emitter component.

The issue is related to errors in privilege management in the Perl interpreter, specifically with the handling of the included directory array ("@INC"). This could allow a local user to gain privileges via a Trojan horse module under the current working directory by exploiting the failure to properly remove period characters from the end of the includes directory array.

The issue is related to the `kssl keytab is available` function in OpenSSL, which, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value. This allows remote attackers to cause a denial of service via SSL cipher negotiation, potentially leading to a daemon crash. The vulnerability may also lead to disruptions in confidentiality, integrity, and availability of protected information.