Ubuntu Security Notice USN-222-1 – Jack Louis of Dyad Security discovered that Perl did not sufficiently check the explicit length argument in format strings. Specially crafted format strings with overly large length arguments led to a crash of the Perl interpreter or even to execution of arbitrary attacker-defined code with the privileges of the user running the Perl program.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/42042/USN-222-1.txt
Source: https://packetstormsecurity.com/files/42042/Ubuntu-Security-Notice-222-1.html