CVE-2018-20574

CVE-2018-20574 affects yaml-cpp (LibYaml-C++) 0.6.2, where the function SingleDocParser::HandleFlowMap can be abused by a crafted YAML file to trigger denial of service (stack consumption and application crash). Public documents corroborate this by listing CVE-2018-20574 in SUSE/openSUSE advisori...

Denial Of Service (DoS)

PyYaml is vulnerable to CVE-2014-9130 through a copied version of libyaml. The version of libyaml used is vulnerable to denial of service DoS attacks. A malicious user can pass a string to the application that can cause a parsing error leading to an infinite loop. This can cause the service to be...

Ruby: Ruby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAML

libYAML 0.1.6 and 0.1.5 has a DoS vulnerablitity known as CVE-2014-9130. Now Ruby 2.4.x bundles fixed version 0.1.7, but 2.3.x and 2.2.x still bundle 0.1.6. Note that I'm the maintainer of Ruby 2.3.x and 2.2.x. Therefore, this report is a kind of remainder...

CVE-2017-5950

The SingleDocParser::HandleNode function in yaml-cpp aka LibYaml-C++ 0.5.3 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file...

libyaml: Use-of-uninitialized-value in yaml_parser_scan_flow_scalar

Project: https://github.com/yaml/libyaml.git Detailed report: https://oss-fuzz.com/testcase?key=5607885063061504 Project: libyaml Fuzzer: libFuzzerlibyamlfuzzer Fuzz target binary: libyamlfuzzer Job Type: libfuzzermsanlibyaml Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

Code injection

The SingleDocParser::HandleNode function in yaml-cpp aka LibYaml-C++ 0.5.3 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file...

CVE-2017-5950

The SingleDocParser::HandleNode function in yaml-cpp aka LibYaml-C++ 0.5.3 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file...

CVE-2017-5950

The SingleDocParser::HandleNode function in yaml-cpp aka LibYaml-C++ 0.5.3 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file...

CVE-2017-5950

yaml-cpp (LibYaml-C++) vulnerability CVE-2017-5950 stems from SingleDocParser::HandleNode and affects 0.5.x series (e.g., 0.5.3). A crafted YAML file can cause stack consumption and application crash (DoS). Remediation per connected advisories: rebuild/upgrade to yaml-cpp 0.6.0 or newer (Fedora 2...

Arbitrary Code Execution

LibYAML is susceptible to arbitrary code execution attacks. A heap-based buffer overflow occurs due to not properly parsing URL in a YAML, allowing the attackers to trigger an arbitrary code execution attack using a long sequence of percent-encoded characters in a URL in a YAML file...

Apple Mac OS X Multiple Vulnerabilities-02 (Nov 2016)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-9130: LibYAML vulnerability | Cloud Foundry

CVE-2014-9130: LibYAML vulnerability Medium Vendor LibYAML Versions Affected Cloud Foundry Ruby Buildpack versions prior to 1.6.25 Description Stanisław Pitucha and Jonathan Gray discovered that LibYAML did not properly handle wrapped strings. An attacker could create specially crafted YAML data ...

openSUSE Security Update : perl-YAML-LibYAML (openSUSE-2016-473)

perl-YAML-LibYAML was updated to fix three security issues. These security issues were fixed : - CVE-2013-6393: The yamlparserscantaguri function in scanner.c in LibYAML before 0.1.5 performed an incorrect cast, which allowed remote attackers to cause a denial of service application crash and...

Heap Based Buffer Overflow

Overview Versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier. As such, they are affected by a heap-based buffer overflow vulnerability that may result in a crash or arbitrary code execution when parsing YAML tags. Recommendation - Update to version 0.2.3 that includes a...

Oracle: Security Advisory (ELSA-2015-0100)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 201403-02

Gentoo Linux Local Security Checks GLSA 201403-02 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Amazon Linux: Security Advisory (ALAS-2012-69)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2014-321)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2015-482)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2014-291)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...