CVE-2014-2525

2014-03-2815:55:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2014-2525

nvd

code execution

buffer overflow

libyaml

security vulnerability

7.4 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.731 High

EPSS

Percentile

98.1%

JSON

Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.

CPENameOperatorVersion
pyyaml:libyamlpyyaml libyamleq0.1.4
pyyaml:libyamlpyyaml libyamlle0.1.5
pyyaml:libyamlpyyaml libyamleq0.1.2
pyyaml:libyamlpyyaml libyamleq0.1.3
pyyaml:libyamlpyyaml libyamleq0.1.1
pyyaml:libyamlpyyaml libyamleq0.0.1
opensuse:leapopensuse leapeq42.1
opensuse:opensuseopensuseeq13.1
opensuse:opensuseopensuseeq13.2

CPE	Name	Operator	Version
pyyaml:libyaml	pyyaml libyaml	eq	0.1.4
pyyaml:libyaml	pyyaml libyaml	le	0.1.5
pyyaml:libyaml	pyyaml libyaml	eq	0.1.2
pyyaml:libyaml	pyyaml libyaml	eq	0.1.3
pyyaml:libyaml	pyyaml libyaml	eq	0.1.1
pyyaml:libyaml	pyyaml libyaml	eq	0.0.1
opensuse:leap	opensuse leap	eq	42.1
opensuse:opensuse	opensuse	eq	13.1
opensuse:opensuse	opensuse	eq	13.2