We already have fix for CVE-2014-2525 in libyaml-0.1.5nb1.
Thanks to wiz@ noted via private e-mail.
Always add pam in PLIST_VARS.