Libyang Input Validation Error Vulnerability

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. An input validation error vulnerability exists in yyparse in versions prior to libyang v1.0-r1. The vulnerability stems from a networked system or product that does not properl...

libyang yyparse() memory misreference vulnerability

libyang is a data modeling language library. A memory misreference vulnerability exists in libyang yyparse, which can be exploited by a remote attacker to submit a special file request and trick the user into parsing it, which can be used to conduct a denial of service attack or execute arbitrary...

libyang lys_extension_instances_free() memory misreference vulnerability

libyang is a data modeling language library. A memory misreference vulnerability exists in libyang lysextensioninstancesfree, which can be exploited by an attacker to submit a special file request and trick the user into parsing it, which can be used in a denial of service attack...

libyang yyparse() memory misreference vulnerability (CNVD-2020-10246)

libyang is a data modeling language library. A memory misreference vulnerability exists in libyang yyparse, which can be exploited by an attacker to submit a special file request and trick the user into parsing it, which can be used to conduct a denial of service attack or execute arbitrary code...

Denial Of Service (DoS)

libyang.so is vulnerable to denial of service DoS. The library do not restrict the input of unprintable characters at the end of the file, causing SIGSEGV signals in yanglint and yangfuzz and crashing the application...

CVE-2019-20398

A NULL pointer dereference flaw occurs in libyang in the function lysextensioninstancesfree due to a copy of unresolved extensions in lysrestrdup. Applications that use libyang to process untrusted input YANG files may crash...

CVE-2019-20396

A heap-based buffer over-read flaw occurs in libyang in function lystypefree due to a malformed pattern statement value. Applications that use libyang to process untrusted input yang files may be vulnerable to this flaw, possibly causing a crash or information leaks...

CVE-2019-20394

A double-free flaw occurs in libyang in function yyparse when a type statement is used in a notification statement. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution...

CVE-2019-20397

A double-free flaw occurs in libyang in function yparse when an organization field is not terminated. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution...

CVE-2019-20392

An invalid memory access flaw was discovered in libyang in the function resolvefeaturevalue when an if-feature statement is used inside a list key node and the feature used is not defined. Applications that use libyang to process untrusted input YANG files may crash...

CVE-2019-20395

A stack-overflow flaw was found in libyang due to a self-referential union type containing leafrefs. Applications that use libyang to process untrusted input YANG files may crash while processing malformed files...

CVE-2019-20393

A double-free flaw occurs in libyang in function yyparse when an empty description is used. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution...

CVE-2019-20391

An invalid memory access flaw occurs in libyang in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to process untrusted input YANG files may crash...

Denial Of Service (DoS)

libyang is vulnerable to denial of service DoS. The attack exists because of self-referential union type containing leafrefs , allowing attacker to input malicious yang file to crash the application...

CVE-2019-20392

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolvefeaturevalue when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash...

DEBIAN-CVE-2019-20397

A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20397

A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20391

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20397

A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20391

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash...