CVE-2013-6393
06.02.2014, 22:55
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.Enginsight
| Vendor | Product | Version |
|---|---|---|
| pyyaml | libyaml | 𝑥 ≤ 0.1.4 |
| pyyaml | libyaml | 0.0.1 |
| pyyaml | libyaml | 0.1.1 |
| pyyaml | libyaml | 0.1.2 |
| pyyaml | libyaml | 0.1.3 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 12.10 |
| canonical | ubuntu_linux | 13.10 |
| redhat | openstack | 3.0 |
| redhat | openstack | 4.0 |
| debian | debian_linux | 6.0 |
| debian | debian_linux | 7.0 |
| opensuse | leap | 42.1 |
| opensuse | opensuse | 11.4 |
| opensuse | opensuse | 13.1 |
| opensuse | opensuse | 13.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| libyaml |
| ||||||||||
| libyaml-libyaml-perl |
|
Common Weakness Enumeration
References