Lucene search
Ivan FratricNODEJS:21HistoryOct 17, 2015 - 7:41 p.m.
Heap Based Buffer Overflow
2015-10-1719:41:46
Ivan Fratric
www.npmjs.com
15
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
Overview
Versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier. As such, they are affected by a heap-based buffer overflow vulnerability that may result in a crash or arbitrary code execution when parsing YAML tags.
Recommendation
- Update to version 0.2.3 that includes a version of LibYAML that contains a fix for this issue.
References
Related
nessus
nessus
Debian DSA-2850-1 : libyaml - heap-based buffer overflow
2014-02-02 00:00:00
Mandriva Linux Security Advisory : yaml (MDVSA-2014:034)
2014-02-17 00:00:00
Ubuntu 12.04 LTS / 12.10 / 13.10 : libyaml vulnerability (USN-2098-1)
2014-02-05 00:00:00
osv
osv
Heap Based Buffer Overflow in libyaml
2020-08-31 22:51:50
openvas
openvas
Debian Security Advisory DSA 2870-1 (libyaml-libyaml-perl - heap-based buffer overflow)
2014-03-08 00:00:00
Ubuntu: Security Advisory (USN-2098-1)
2014-02-11 00:00:00
Mageia: Security Advisory (MGASA-2014-0040)
2022-01-28 00:00:00
prion
prion
Heap overflow
2014-02-06 22:55:00
debian
debian
[SECURITY] [DSA 2870-1] libyaml-libyaml-perl security update
2014-03-08 12:52:12
[SECURITY] [DSA 2850-1] libyaml security update
2014-01-31 21:25:45
[SECURITY] [DSA 2850-1] libyaml security update
2014-01-31 21:25:45
amazon
amazon
Important: libyaml
2014-02-26 14:27:00
Important: perl-YAML-LibYAML
2014-04-17 14:18:00
fedora
fedora
[SECURITY] Fedora 20 Update: libyaml-0.1.4-6.fc20
2014-02-08 05:00:26
[SECURITY] Fedora 19 Update: libyaml-0.1.4-6.fc19
2014-02-08 05:01:45
[SECURITY] Fedora 20 Update: perl-YAML-LibYAML-0.41-4.fc20
2014-04-07 03:24:16
securityvulns
securityvulns
[USN-2098-1] LibYAML vulnerability
2014-02-10 00:00:00
libYAML buffer overflow
2014-03-31 00:00:00
[oss-security] CVE request: various NodeJS module vulnerabilities
2014-05-15 00:00:00
github
github
Heap Based Buffer Overflow in libyaml
2020-08-31 22:51:50
debiancve
debiancve
CVE-2013-6393
2014-02-06 22:55:00
mageia
mageia
Updated yaml packages fix CVE-2013-6393
2014-02-08 23:11:21
Updated perl-YAML-LibYAML package fixes security vulnerabilies
2014-04-03 05:02:12
cve
cve
CVE-2013-6393
2014-02-06 22:55:00
freebsd
freebsd
libyaml heap overflow resulting in possible code execution
2013-11-24 00:00:00
ubuntucve
ubuntucve
CVE-2013-6393
2014-01-27 00:00:00
gentoo
gentoo
LibYAML: Arbitrary code execution
2014-03-08 00:00:00
ubuntu
ubuntu
LibYAML vulnerability
2014-02-04 00:00:00
libyaml-libyaml-perl vulnerabilities
2014-04-03 00:00:00
redhat
redhat
(RHSA-2014:0415) Important: libyaml security update
2014-04-17 00:00:00
(RHSA-2014:0364) Important: ruby193-libyaml security update
2014-04-03 00:00:00
(RHSA-2014:0355) Important: ruby193-libyaml security update
2014-04-02 00:00:00
centos
centos
ruby193 security update
2014-05-21 17:51:09
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related for NODEJS:21