libyang yyparse() memory misreference vulnerability

libyang is a data modeling language library. A memory misreference vulnerability exists in libyang yyparse, which can be exploited by a remote attacker to submit a special file request and trick the user into parsing it, which can be used to conduct a denial of service attack or execute arbitrary...

Denial Of Service (DoS)

libyang.so is vulnerable to denial of service DoS. The library do not restrict the input of unprintable characters at the end of the file, causing SIGSEGV signals in yanglint and yangfuzz and crashing the application...

CVE-2019-20398

A NULL pointer dereference flaw occurs in libyang in the function lysextensioninstancesfree due to a copy of unresolved extensions in lysrestrdup. Applications that use libyang to process untrusted input YANG files may crash...

CVE-2019-20396

A heap-based buffer over-read flaw occurs in libyang in function lystypefree due to a malformed pattern statement value. Applications that use libyang to process untrusted input yang files may be vulnerable to this flaw, possibly causing a crash or information leaks...

CVE-2019-20394

A double-free flaw occurs in libyang in function yyparse when a type statement is used in a notification statement. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution...

CVE-2019-20397

A double-free flaw occurs in libyang in function yparse when an organization field is not terminated. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution...

CVE-2019-20395

A stack-overflow flaw was found in libyang due to a self-referential union type containing leafrefs. Applications that use libyang to process untrusted input YANG files may crash while processing malformed files...

CVE-2019-20392

An invalid memory access flaw was discovered in libyang in the function resolvefeaturevalue when an if-feature statement is used inside a list key node and the feature used is not defined. Applications that use libyang to process untrusted input YANG files may crash...

CVE-2019-20393

A double-free flaw occurs in libyang in function yyparse when an empty description is used. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution...

CVE-2019-20391

An invalid memory access flaw occurs in libyang in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to process untrusted input YANG files may crash...

Denial Of Service (DoS)

libyang is vulnerable to denial of service DoS. The attack exists because of self-referential union type containing leafrefs , allowing attacker to input malicious yang file to crash the application...

CVE-2019-20396

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lysparsepath parsing...

CVE-2019-20394

A double-free is present in libyang before v1.0-r3 in the function yyparse when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

DEBIAN-CVE-2019-20393

A double-free is present in libyang before v1.0-r1 in the function yyparse when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

DEBIAN-CVE-2019-20391

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20392

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolvefeaturevalue when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash...

DEBIAN-CVE-2019-20392

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolvefeaturevalue when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash...

DEBIAN-CVE-2019-20396

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lysparsepath parsing...

CVE-2019-20392

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolvefeaturevalue when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash...

CVE-2019-20391

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolvefeaturevalue when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash...