Lucene search
AmazonALAS-2014-321HistoryApr 10, 2014 - 11:54 p.m.
Important: libyaml
2014-04-1023:54:00
alas.aws.amazon.com
19
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.731 High
EPSS
Percentile
98.1%
Issue Overview:
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
Affected Packages:
libyaml
Issue Correction:
Run yum update libyaml to update your system.
New Packages:
i686:
libyaml-debuginfo-0.1.6-1.6.amzn1.i686
libyaml-devel-0.1.6-1.6.amzn1.i686
libyaml-0.1.6-1.6.amzn1.i686
src:
libyaml-0.1.6-1.6.amzn1.src
x86_64:
libyaml-devel-0.1.6-1.6.amzn1.x86_64
libyaml-debuginfo-0.1.6-1.6.amzn1.x86_64
libyaml-0.1.6-1.6.amzn1.x86_64
Additional References
Red Hat: CVE-2014-2525
Mitre: CVE-2014-2525
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | libyaml-debuginfo | < 0.1.6-1.6.amzn1 | libyaml-debuginfo-0.1.6-1.6.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | libyaml-devel | < 0.1.6-1.6.amzn1 | libyaml-devel-0.1.6-1.6.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | libyaml | < 0.1.6-1.6.amzn1 | libyaml-0.1.6-1.6.amzn1.i686.rpm |
| Amazon Linux | 1 | x86_64 | libyaml-devel | < 0.1.6-1.6.amzn1 | libyaml-devel-0.1.6-1.6.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | libyaml-debuginfo | < 0.1.6-1.6.amzn1 | libyaml-debuginfo-0.1.6-1.6.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | libyaml | < 0.1.6-1.6.amzn1 | libyaml-0.1.6-1.6.amzn1.x86_64.rpm |
Related
nessus
nessus
Ubuntu 12.04 LTS / 12.10 / 13.10 : libyaml vulnerability (USN-2160-1)
2014-04-04 00:00:00
Amazon Linux AMI : libyaml (ALAS-2014-321)
2014-04-23 00:00:00
openvas
openvas
Debian Security Advisory DSA 2884-1 (libyaml - security update)
2014-03-26 00:00:00
Slackware: Security Advisory (SSA:2014-111-01)
2022-04-21 00:00:00
Ubuntu Update for libyaml USN-2160-1
2014-04-08 00:00:00
debian
debian
[SECURITY] [DSA 2885-1] libyaml-libyaml-perl security update
2014-03-26 19:53:26
[SECURITY] [DSA 2884-1] libyaml security update
2014-03-26 19:52:18
[SECURITY] [DSA 2884-1] libyaml security update
2014-03-26 19:52:18
veracode
veracode
Arbitrary Code Execution
2017-02-02 06:05:46
debiancve
debiancve
CVE-2014-2525
2014-03-28 15:55:00
osv
osv
libyaml - security update
2014-03-26 00:00:00
libyaml-libyaml-perl - security update
2014-03-26 00:00:00
securityvulns
securityvulns
[SECURITY] [DSA 2885-1] libyaml-libyaml-perl security update
2014-03-27 00:00:00
[oCERT-2014-003] LibYAML input sanitization errors
2014-03-31 00:00:00
[SECURITY] [DSA 2884-1] libyaml security update
2014-03-27 00:00:00
cve
cve
CVE-2014-2525
2014-03-28 15:55:00
freebsd
freebsd
LibYAML input sanitization errors
2014-03-11 00:00:00
checkpoint_advisories
checkpoint_advisories
gentoo
gentoo
LibYAML: Arbitrary code execution
2014-05-23 00:00:00
slackware
slackware
[slackware-security] libyaml
2014-04-21 21:12:43
ubuntu
ubuntu
LibYAML vulnerability
2014-04-03 00:00:00
libyaml-libyaml-perl vulnerabilities
2014-04-03 00:00:00
prion
prion
Heap overflow
2014-03-28 15:55:00
seebug
seebug
LibYAML 'yaml_parser_scan_uri_escapes（）'函数远程堆缓冲区溢出漏洞
2014-03-28 00:00:00
ubuntucve
ubuntucve
CVE-2014-2525
2014-03-27 00:00:00
mageia
mageia
Updated libyaml package fixes security vulnerability
2014-04-03 04:33:14
Updated perl-YAML-LibYAML package fixes security vulnerabilies
2014-04-03 05:02:12
rubygems
rubygems
CVE-2014-2525 libyaml: heap-based buffer overflow when parsing URLs
2014-03-25 20:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: perl-YAML-LibYAML-0.41-4.fc19
2014-04-07 03:25:42
[SECURITY] Fedora 20 Update: perl-YAML-LibYAML-0.41-4.fc20
2014-04-07 03:24:16
[SECURITY] Fedora 19 Update: libyaml-0.1.6-1.fc19
2014-04-05 04:57:08
redhat
redhat
(RHSA-2014:0354) Important: libyaml security update
2014-04-02 00:00:00
(RHSA-2014:0353) Important: libyaml security update
2014-04-02 00:00:00
(RHSA-2014:0415) Important: libyaml security update
2014-04-17 00:00:00
amazon
amazon
Important: perl-YAML-LibYAML
2014-04-17 14:18:00
centos
centos
ruby193 security update
2014-05-21 17:51:09
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.731 High
EPSS
Percentile
98.1%
Related for ALAS-2014-321