CVE-2019-20393

The CVE-2019-20393 issue affects the libyang library (yyparse function) where a double-free occurs when parsing an empty description. Affected versions are libyang before v1.0-r1. Impact described as a crash or potentially code execution in applications that parse untrusted YAML input. The proble...

CVE-2019-20394

A double-free is present in libyang before v1.0-r3 in the function yyparse when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20396: Improper Restriction of Operations within the Bounds of a Memory Buffer

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lysparsepath parsing...

CVE-2019-20392: Improper Restriction of Operations within the Bounds of a Memory Buffer

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolvefeaturevalue when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20397

A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20395

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20393

A double-free is present in libyang before v1.0-r1 in the function yyparse when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20396

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lysparsepath parsing...

CVE-2019-20394

CVE-2019-20394 affects libyang. The vulnerability is a double-free in yyparse() when a type statement is used inside a notification statement, enabling denial of service and potentially code execution if untrusted YANG input is parsed. Public references in the connected documents identify the aff...

CVE-2019-20396

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lysparsepath parsing...

CVE-2019-20395: Uncontrolled Recursion

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20397: Double Free

A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20397

A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20392

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolvefeaturevalue when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20393

A double-free is present in libyang before v1.0-r1 in the function yyparse when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

CVE-2019-20392

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolvefeaturevalue when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20391

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20397

CVE-2019-20397 is a memory corruption flaw in libyang prior to v1.0-r1, caused by a double-free in yyparse() when an organization field is not terminated. This can crash the application or lead to arbitrary code execution if untrusted YANG data is parsed. Upstream details are confirmed, and affec...

CVE-2019-20392

The CVE-2019-20392 issue affects libyang prior to v1.0-r1, where resolve_feature_value() can take an invalid memory path when an if-feature is used inside a list key node and the feature is not defined. This can cause application crashes when parsing untrusted YANG input. No exploitation details ...

CVE-2019-20394: Double Free

A double-free is present in libyang before v1.0-r3 in the function yyparse when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...