Heap Based Buffer Overflow in libyaml
Versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier. As such, they are affected by a heap-based buffer overflow vulnerability that may result in a crash or arbitrary code execution when parsing YAML tags. ## Recommendation - Update to version 0.2.3 that includes a version of LibYAML that contains a fix for this issue.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2013-6393US | medium6.8 | — | ||
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://advisories.mageia.org/MGASA-2014-0040.htmlWEB
- http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.htmlWEB
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.htmlWEB
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-6393WEB
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00064.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00065.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2016-04/msg00050.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan