4608 matches found
openSUSE Security Update : cobbler (openSUSE-SU-2012:0639-1)
Specially crafted YAML could allow attackers to execute arbitrary code due to the use of yaml.load instead of yaml.safeload. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-287...
openSUSE Security Update : perl-YAML-LibYAML (openSUSE-SU-2012:1000-1)
This update of perl-YAML-LibYAML fixed multiple format string flaws that could cause a crash or potentially allow the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Upda...
openSUSE Security Update : cobbler (openSUSE-SU-2012:0557-1)
Specially crafted YAML could allow attackers to execute arbitrary code due to the use of yaml.load instead of yaml.safeload. Cobbler-web was prone to Cross-Site-Request-Forgery CSRF %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
openSUSE Security Update : puppet (openSUSE-SU-2013:1370-1)
A potential remote code execution via YAML was fixed in puppet. CVE-2013-3567 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2013-661. The text description of this plugin is C SUSE...
CVE-2013-1397
Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the 1 Yaml::parse or 2 Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348...
CVE-2013-1348
The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397...
Design/Logic Flaw
The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397...
Design/Logic Flaw
Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the 1 Yaml::parse or 2 Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348...
CVE-2013-1348
CVE-2013-1348 affects Symfony 2.0.x before 2.0.22 where the YAML parsing path in Yaml::parse can allow remote code execution of PHP via a crafted PHP file. Root cause: insecure handling in YAML parsing that enables arbitrary PHP code execution. Impact: remote attacker could execute code with the ...
CVE-2013-1397
CVE-2013-1397 affects Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x, where a remote attacker can execute arbitrary PHP code by sending a serialized PHP object to the Yaml::parse or Yaml\Parser::parse function. Root cause: insecure handling in YAML parsing leading to code execution. I...
CVE-2013-1348
The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397...
CVE-2013-5036
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the 1 namespace parameter to the deobfuscation function or 2 sourcemap parameter to the sourcemap function in app/controllers/api/v1controller.rb...
CVE-2013-5036
The CVE-2013-5036 issue pertains to Square Squash’s YAML processing, allowing remote code execution via a YAML document in (1) the namespace parameter to the deobfuscation function or (2) the sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb. Connected advisori...
CVE-2013-5036
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the 1 namespace parameter to the deobfuscation function or 2 sourcemap parameter to the sourcemap function in app/controllers/api/v1controller.rb...
Deserialization of untrusted data
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the 1 namespace parameter to the deobfuscation function or 2 sourcemap parameter to the sourcemap function in app/controllers/api/v1controller.rb...
GLSA-201405-27 : LibYAML: Arbitrary code execution
The remote host is affected by the vulnerability described in GLSA-201405-27 LibYAML: Arbitrary code execution The yamlparserscanuriescapes function does not properly expand strings passed as input, which can result in a heap-based buffer overflow. Impact : An attacker could provide a specially...
LibYAML: Arbitrary code execution
Background LibYAML is a YAML 1.1 parser and emitter written in C. Description The yamlparserscanuriescapes function does not properly expand strings passed as input, which can result in a heap-based buffer overflow. Impact An attacker could provide a specially-crafted YAML document, which, when...
ruby193 security update
CentOS Errata and Security Advisory CESA-2014:0355 Updated ruby193-libyaml packages that fix two security issues are now available for Red Hat Software Collections 1. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System...