CVE-2019-20395

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20391

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20391

CVE-2019-20391 affects libyang before v1.0-r3. The flaw is an invalid memory access in resolve_feature_value() when an if-feature statement is used inside a bit, which may cause a crash when parsing untrusted YANG input. Impact details in sources indicate potential denial of service with crashes;...

CVE-2019-20397

CVE-2019-20397 is a memory corruption flaw in libyang prior to v1.0-r1, caused by a double-free in yyparse() when an organization field is not terminated. This can crash the application or lead to arbitrary code execution if untrusted YANG data is parsed. Upstream details are confirmed, and affec...

CVE-2019-20391

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20393

A double-free is present in libyang before v1.0-r1 in the function yyparse when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20396

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lysparsepath parsing...

PT-2020-1239 · Libyang · Libyang

Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0-r1 Description: A stack consumption issue is present due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash. Recommendations: For...

CVE-2019-20393

A double-free is present in libyang before v1.0-r1 in the function yyparse when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20398

CVE-2019-20398 concerns a NULL pointer dereference in libyang in the function lys_extension_instances_free(), caused by copying unresolved extensions in lys_restr_dup() for libyang builds before v1.0-r3. Affected software may crash when parsing untrusted YANG inputs. Remediation references across...

CVE-2019-20398

A NULL pointer dereference is present in libyang before v1.0-r3 in the function lysextensioninstancesfree due to a copy of unresolved extensions in lysrestrdup. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20395

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash...

PT-2020-1242 · Libyang · Libyang

Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0-r3 Description: A NULL pointer dereference issue is present in the lys extension instances free function due to a copy of unresolved extensions in lys restr dup. This can cause applications that use libyang to...

CVE-2019-20394

CVE-2019-20394 affects libyang. The vulnerability is a double-free in yyparse() when a type statement is used inside a notification statement, enabling denial of service and potentially code execution if untrusted YANG input is parsed. Public references in the connected documents identify the aff...

CVE-2019-20392

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolvefeaturevalue when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20396

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lysparsepath parsing...

CVE-2019-20394

A double-free is present in libyang before v1.0-r3 in the function yyparse when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20397

A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20398

A NULL pointer dereference is present in libyang before v1.0-r3 in the function lysextensioninstancesfree due to a copy of unresolved extensions in lysrestrdup. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20397

A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...