CVE-2013-6393

LibYAML < 0.1.5 - Heap-Based Buffer Overflow via Crafted YAML Tags

Title source: llm
STIX 2.1

Description

The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.

References (21)

Core 21
Core References
Issue Tracking, Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1033990
Third Party Advisory x_refsource_confirm
https://support.apple.com/kb/HT6536
Issue Tracking x_refsource_confirm
https://bitbucket.org/xi/libyaml/commits/tag/0.1.5
Various Sources x_refsource_confirm
https://puppet.com/security/cve/cve-2013-6393
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2098-1
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-02/msg00065.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2870
Broken Link vendor-advisory x_refsource_apple
http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
Broken Link vendor-advisory x_refsource_apple
http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/102716
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:060
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/65258
Third Party Advisory x_refsource_confirm
http://advisories.mageia.org/MGASA-2014-0040.html
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0355.html
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-02/msg00064.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0354.html
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-04/msg00050.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2850
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0353.html

Scores

EPSS 0.0806
EPSS Percentile 92.2%

Details

CWE
CWE-119
Status published
Products (17)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 12.10
canonical/ubuntu_linux 13.10
debian/debian_linux 6.0
debian/debian_linux 7.0
npm/libyaml 0 - 0.2.3npm
opensuse/leap 42.1
opensuse/opensuse 11.4
opensuse/opensuse 13.1
opensuse/opensuse 13.2
... and 7 more
Published Feb 06, 2014
Tracked Since Feb 18, 2026