CVE-2013-6393
Summary
| CVE | CVE-2013-6393 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2014-02-06 22:55:00 UTC |
|---|
| Updated | 2018-10-30 16:27:00 UTC |
|---|
| Description | The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Attachment 847926 Details for Bug 1033990
– String overflow patch |
MISC |
bugzilla.redhat.com |
Issue Tracking |
| openSUSE-SU-2015:0319-1: moderate: Security update for perl-YAML-LibYAML |
SUSE |
lists.opensuse.org |
Third Party Advisory |
| 102716 |
OSVDB |
osvdb.org |
|
| openSUSE-SU-2016:1067-1: moderate: Security update for perl-YAML-LibYAML |
SUSE |
lists.opensuse.org |
Third Party Advisory |
| xi / libyaml
/ Commits
— Bitbucket |
CONFIRM |
bitbucket.org |
Issue Tracking |
| NEOHAPSIS - Peace of Mind Through Integrity and Insight |
APPLE |
archives.neohapsis.com |
Broken Link |
| NEOHAPSIS - Peace of Mind Through Integrity and Insight |
APPLE |
archives.neohapsis.com |
Broken Link |
| openSUSE-SU-2014:0273-1: moderate: update for libyaml |
SUSE |
lists.opensuse.org |
Third Party Advisory |
| Debian -- Security Information -- DSA-2870-1 libyaml-libyaml-perl |
DEBIAN |
www.debian.org |
Third Party Advisory |
| Red Hat Customer Portal |
REDHAT |
rhn.redhat.com |
Third Party Advisory |
| Bug 1033990 – CVE-2013-6393 libyaml: heap-based buffer overflow when parsing YAML tags |
CONFIRM |
bugzilla.redhat.com |
Issue Tracking, Patch |
| USN-2098-1: LibYAML vulnerability | Ubuntu |
UBUNTU |
www.ubuntu.com |
Third Party Advisory |
| LibYAML 'scanner.c' Remote Heap Based Buffer Overflow Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| openSUSE-SU-2014:0272-1: moderate: update for libyaml |
SUSE |
lists.opensuse.org |
Third Party Advisory |
| Support / Security / Advisories / / MDVSA-2015:060 | Mandriva |
MANDRIVA |
www.mandriva.com |
Third Party Advisory |
| CVE-2013-6393 | Puppet |
CONFIRM |
puppet.com |
|
| Red Hat Customer Portal |
REDHAT |
rhn.redhat.com |
Third Party Advisory |
| Red Hat Customer Portal |
REDHAT |
rhn.redhat.com |
Third Party Advisory |
| Mageia Advisory: MGASA-2014-0040 - Updated yaml packages fix CVE-2013-6393 |
CONFIRM |
advisories.mageia.org |
Third Party Advisory |
| About the security content of OS X Server v4.0 - Apple Support |
CONFIRM |
support.apple.com |
Third Party Advisory |
| Debian -- Security Information -- DSA-2850-1 libyaml |
DEBIAN |
www.debian.org |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 980716 Nodejs (npm) Security Update for libyaml (GHSA-m75h-cghq-c8h5)
