new packages: libyang

An update is available for libyang. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

GLSA-202107-54 : libyang: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202107-54 libyang: Multiple vulnerabilities Multiple vulnerabilities have been discovered in libyang. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for detail...

The vulnerability of the read_yin_container() function in the syntax analyzer and data modeling tool of the YANG Libyang language lies in its unvalidated return value. This allows attackers to trigger a service failure.

The vulnerability of the readyincontainer function in the syntax analyzer and data modeling tool of the YANG Libyang language is related to the lack of checking for NULL values in retval-extr. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the lyxml_parse_mem() function in the syntax analyzer and data modeling tool YANG Libyang, related to an uncontrolled recursion, allows attackers to cause service failures.

The vulnerability of the lyxmlparsemem function, a syntax analyzer and tool for data modeling in the YANG Libyang language, is related to an uncontrolled recursion in the lyxmlparseelem function. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the read_yin_leaf() function in the syntax analyzer and tools of the YANG data modeling language Libyang, related to an unvalidated return value, allows attackers to trigger service failures.

The vulnerability of the readyinleaf function in the syntax analyzer and data modeling tool of the YANG Libyang language is related to the lack of checking for NULL values in retval-extr. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the lys_node_free() function in the syntax analyzer and modeling tool of the YANG Libyang language, related to the insufficient use of the assert() function, allows attackers to trigger a service failure.

The vulnerability of the lysnodefree function in the syntax analyzer and modeling tool of the YANG Libyang language is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the ext_get_plugin() function in the syntax analyzer and data modeling tool of YANG Libyang, related to an unvalidated return value, allows a malicious actor to trigger a service failure.

The vulnerability of the extgetplugin function in the syntax analyzer and data modeling tool of the YANG Libyang language is related to the lack of checking for a NULL revision. Exploiting this vulnerability could allow an attacker to cause service failures...

Denial Of Service (DoS)

libyang is vulnerable to denial of service. The vulnerability exists in multiple functions of parseryin.c due to the lack of sanitization of the value retval-extr which allows an attacker to crash the application via malicious input...

Denial Of Service (DoS)

A stack overflow in libyang can cause a denial of service through function lyxmlparsemem. lyxmlparseelem function will be called recursively, which will consume stack space and lead to crash...

Denial Of Service (DoS)

libyang is vulnerable to denial of service. The function readyincontainer fails to validate the value of retval-extr is NULL., resulting in a crash...

Denial Of Service (DoS)

libyang is vulnerable to denial of service. The function extgetplugin in libyang doesn't check whether the value of revision is NULL. If revision is NULL, leading the operation of strcmprevision, extpluginsu.revision to a crash...

CVE-2021-28906

A flaw was found in libyang. Missing checks in several readyin functions lead to NULL pointer dereferences possibly allowing a remote attacker to crash an application that uses libyang with user-controlled YIN formats. The highest threat from this vulnerability is the service availability...

CVE-2021-28903

A flaw was found in libyang. An uncontrolled recursion in lyxmlparseelem function allows a remote attacker to crash an application that uses libyang with user-controlled XML data. The highest threat from this vulnerability is the service availability...

CVE-2021-28904

A flaw was found in libyang. A NULL pointer dereference in extgetplugin function allows a remote attacker to crash an application that uses libyang with user-controlled YANG data. The highest threat from this vulnerability is the service availability...

CVE-2021-28905

A flaw was found in libyang. An assertion in lysnodefree function may be reached or, if assertions are disabled, a NULL pointer dereference could be triggered allowing a remote attacker to crash an application that uses libyang with user-controlled YIN data. The highest threat from this...

CVE-2021-28902

A flaw was found in libyang. Missing checks in several readyin functions lead to NULL pointer dereferences possibly allowing a remote attacker to crash an application that uses libyang with user-controlled YIN formats. The highest threat from this vulnerability is the service availability...

Unspecified vulnerability in libyang (CNVD-2021-37200)

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A security vulnerability exists in libyang v1.0.225 and earlier versions, which stems from the readyincontainer function not checking if the value of retval-extr is NULL. no...

Unspecified vulnerability in libyang (CNVD-2021-37201)

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A security vulnerability exists in libyang v1.0.225 and earlier versions, which stems from a failure to check if the value of revision is NULL in the extgetplugin function.No...

Libyang has an unspecified vulnerability

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A security vulnerability exists in libyang version 1.0.225 and earlier versions, which originates in lysnodefree, which does not check if the value of revision is NULL. no...

Unspecified vulnerability in libyang (CNVD-2021-40524)

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A security vulnerability exists in libyang version 1.0.225 and earlier versions, which originates in readyinleaf, which does not check if the value of revision is NULL. no...