LibYAML Scanner yaml_parser_scan_uri_escapes Heap Buffer Overflow (CVE-2014-2525)

A heap buffer overflow vulnerability has been reported in LibYAML's scanner. This vulnerability is due to insufficient validation of percent encoded text in the URI of tags within YAML documents. A remote attacker can exploit this vulnerability by providing a specially crafted YAML document...

openSUSE Security Update : libyaml (openSUSE-SU-2014:0381-1)

libyaml was updated to fix a regression introduced by the previous security patch for CVE-2013-6393. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-215. The text description of...

openSUSE Security Update : perl-YAML-LibYAML (openSUSE-SU-2012:1000-1)

This update of perl-YAML-LibYAML fixed multiple format string flaws that could cause a crash or potentially allow the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Upda...

openSUSE Security Update : libyaml (openSUSE-SU-2014:0272-1)

This update fixes the following security issue with libyaml : - bnc860617: Fixed heap based buffer overflow due to integer misuse CVE-2013-6393 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE Security Update : libyaml (openSUSE-SU-2014:0500-1)

libyaml was updated to fix a heap overflow during parsing. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-281. The text description of this plugin is C SUSE LLC...

GLSA-201405-27 : LibYAML: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201405-27 LibYAML: Arbitrary code execution The yamlparserscanuriescapes function does not properly expand strings passed as input, which can result in a heap-based buffer overflow. Impact : An attacker could provide a specially...

LibYAML: Arbitrary code execution

Background LibYAML is a YAML 1.1 parser and emitter written in C. Description The yamlparserscanuriescapes function does not properly expand strings passed as input, which can result in a heap-based buffer overflow. Impact An attacker could provide a specially-crafted YAML document, which, when...

CentOS 6 : Important: / ruby193-libyaml (CESA-2014:0355)

The remote CentOS host is missing a security update which has been documented in Red Hat advisory RHSA-2014:0355. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Red Hat Security Advisory RHSA-2014:0355 and CentOS...

LibYAML Scanner yaml_parser_scan_uri_escapes Heap Buffer Overflow - ver 2 (CVE-2014-2525)

A heap buffer overflow vulnerability has been reported in LibYAML's scanner. This vulnerability is due to insufficient validation of percent encoded text in the URI of tags within YAML documents. A remote attacker can exploit this vulnerability by providing a specially crafted YAML document...

ruby193 security update

CentOS Errata and Security Advisory CESA-2014:0355 Updated ruby193-libyaml packages that fix two security issues are now available for Red Hat Software Collections 1. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System...

Amazon Linux AMI : perl-YAML-LibYAML (ALAS-2014-324)

The yamlparserscantaguri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow...

Amazon Linux AMI : libyaml (ALAS-2014-321)

Heap-based buffer overflow in the yamlparserscanuriescapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file. C Tenable Network Security, Inc. The descriptive text and package...

Slackware 13.1 / 13.37 / 14.0 / 14.1 / current : libyaml (SSA:2014-111-01)

New libyaml packages are available for Slackware 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2014-111-01. The text itself ...

[slackware-security] libyaml

New libyaml packages are available for Slackware 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/libyaml-0.1.6-i486-1slack14.1.txz: Upgraded. This update fixes a heap overflow in URI escape parsing of YAML in...

libyaml: heap-based buffer overflow when parsing YAML tags

A heap based buffer oveflow exists in the libyaml package such that a remote attacker could provide a specifically crafted YAML document when parsed by the application could result in remote code execution and complete compromise of the system...

Important: Red Hat Security Advisory: libyaml security update

Updated libyaml packages that fix two security issues are now available for Red Hat Common for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severi...

libyaml: heap-based buffer overflow when parsing URLs

A heap based buffer overflow exists in the libyaml package such that an attacker by supplying a specially crafted yaml document when parsed by the application might result in remote code execution leading to complete compromise of the system...

Important: perl-YAML-LibYAML

Issue Overview: The yamlparserscantaguri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buff...

Mandriva Linux Security Advisory : perl-YAML-LibYAML (MDVSA-2014:069)

Updated perl-YAML-LibYAML packages fix security vulnerabilities : Florian Weimer of the Red Hat Product Security Team discovered a heap-based buffer overflow flaw in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a YAML document with a specially crafted tag...

Important: libyaml

Issue Overview: Heap-based buffer overflow in the yamlparserscanuriescapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file. Affected Packages: libyaml Issue Correction: Run yum...