libyang: invalid memory access when if-feature statement is used inside a list key node

An invalid memory access flaw was discovered in libyang in the function resolvefeaturevalue when an if-feature statement is used inside a list key node and the feature used is not defined. Applications that use libyang to process untrusted input YANG files may crash...

Moderate: Red Hat Enhancement Advisory: libyang bug fix and enhancement update

An update for libyang is now available for Red Hat Enterprise Linux 8. For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section...

libyang: invalid memory access in resolve_feature_value() when a if-feature is used inside a bit

An invalid memory access flaw occurs in libyang in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to process untrusted input YANG files may crash...

libyang: double-free in yyparse() when a type statement is used in a notification statement

A double-free flaw occurs in libyang in function yyparse when a type statement is used in a notification statement. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution...

libyang bug fix and enhancement update

An update is available for libyang. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

libyang bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

ALEA-2021:1906 libyang bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

PT-2021-4114 · Libyang +2 · Libyang +2

Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0.226 Description: The issue is related to the function lys node free in the libyang library, where it incorrectly asserts that the value of node-module cannot be NULL. However, in certain cases, node-module can...

PT-2021-4115 · Libyang +2 · Libyang +2

Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0.225 Description: The issue is related to the function ext get plugin in the libyang library, where it fails to check if the revision value is NULL. This oversight can lead to a crash when the strcmp function is...

PT-2021-4098 · Libyang +2 · Libyang +2

Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0.225 Description: The issue is related to a stack overflow in the libyang library, which can cause a denial of service. This occurs due to uncontrolled recursion of the lyxml parse elem function when lyxml parse m...

PT-2021-4097 · Libyang +2 · Libyang +2

Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0.226 Description: The issue is related to the function read yin container in the libyang library, which fails to check if the value of retval-extr is NULL. This can lead to a crash when attempting to access...

PT-2021-4113 · Libyang +2 · Libyang +2

Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0.226 Description: The issue is related to the function read yin leaf in the libyang library, which fails to check if the value of retval-extr is NULL. This can lead to a crash when attempting to access...

CentOS 8 : libyang (CESA-2019:4360)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:4360 advisory. - libyang: stack-based buffer overflow in makecanonical when bits leaf type is used CVE-2019-19333 - libyang: stack-based buffer overflow in...

The vulnerability of the syntax analyzer and the YANG data modeling tool, Libyang, arises from writing beyond buffer boundaries in memory. This allows attackers to trigger service failures or execute arbitrary code.

The vulnerability of the syntax analyzer and the YANG data modeling language toolset lies in the writing beyond buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code...

Denial Of Service (DoS)

libyang is vulnerable to denial of service DoS. The vulnerability exists as an invalid memory access bug occurs through the resolveiffeature function when an if-feature is used inside a bit...

Double-free

libyang.so is susceptible to double free vulnerability. It exists in the function yyparse when empty description is used...

Libyang Resource Management Error Vulnerability

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A resource management error vulnerability exists in versions prior to libyang 1.0-r1. The vulnerability stems from mismanagement of system resources e.g., memory, disk space,...

libyang resource management error vulnerability (CNVD-2020-10241)

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A resource management error vulnerability exists in the 'yyparse' function in versions of libyang prior to 1.0-r1. An attacker can exploit this vulnerability to cause an...

libyang buffer overflow vulnerability (CNVD-2020-10242)

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A buffer overflow vulnerability exists in the 'resolvefeaturevalue' function in versions of libyang prior to 1.0-r1. An attacker can exploit this vulnerability to cause the...

libyang buffer overflow vulnerability (CNVD-2020-10243)

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A buffer overflow vulnerability exists in the 'resolvefeaturevalue' function in versions prior to libyang v1.0-r3. An attacker can exploit this vulnerability to cause the...