Heap Based Buffer Overflow in libyaml
Versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier. As such, they are affected by a heap-based buffer overflow vulnerability that may result in a crash or arbitrary code execution when parsing YAML tags. ## Recommendation - Update to version 0.2.3 that includes a version of LibYAML that contains a fix for this issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-6393US | medium6.8 | — | ||
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash… | ||||
02
references
External citations — patches, advisories, analysis.
- http://advisories.mageia.org/MGASA-2014-0040.htmlWEB
- http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.htmlWEB
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.htmlWEB
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-6393WEB
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00064.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00065.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2016-04/msg00050.htmlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan