CVE-2019-19334

CVE	CVE-2019-19334
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-12-06 16:15:00 UTC
Updated	2023-11-07 03:07:00 UTC
Description	In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.

Problem Types: CWE-787

Type	Vendor	Product	Version	Update	Edition	Language
Application	Cesnet	Libyang	0.11	r1	All	All
Application	Cesnet	Libyang	0.11	r2	All	All
Application	Cesnet	Libyang	0.12	r1	All	All
Application	Cesnet	Libyang	0.12	r2	All	All
Application	Cesnet	Libyang	0.13	r1	All	All
Application	Cesnet	Libyang	0.13	r2	All	All
Application	Cesnet	Libyang	0.14	r1	All	All
Application	Cesnet	Libyang	0.15	r1	All	All
Application	Cesnet	Libyang	0.16	r1	All	All
Application	Cesnet	Libyang	0.16	r2	All	All
Application	Cesnet	Libyang	0.16	r3	All	All
Application	Cesnet	Libyang	1.0	r1	All	All
Application	Cesnet	Libyang	1.0	r2	All	All
Application	Cesnet	Libyang	1.0	r3	All	All
Application	Cesnet	Libyang	1.0	r4	All	All
Application	Cesnet	Libyang	0.11	r1	All	All
Application	Cesnet	Libyang	0.11	r2	All	All
Application	Cesnet	Libyang	0.12	r1	All	All
Application	Cesnet	Libyang	0.12	r2	All	All
Application	Cesnet	Libyang	0.13	r1	All	All
Application	Cesnet	Libyang	0.13	r2	All	All
Application	Cesnet	Libyang	0.14	r1	All	All
Application	Cesnet	Libyang	0.15	r1	All	All
Application	Cesnet	Libyang	0.16	r1	All	All
Application	Cesnet	Libyang	0.16	r2	All	All
Application	Cesnet	Libyang	0.16	r3	All	All
Application	Cesnet	Libyang	1.0	r1	All	All
Application	Cesnet	Libyang	1.0	r2	All	All
Application	Cesnet	Libyang	1.0	r3	All	All
Application	Cesnet	Libyang	1.0	r4	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Operating System	Redhat	Enterprise Linux	8.0	All	All	All
Operating System	Redhat	Enterprise Linux	8.0	All	All	All

Reference	Source	Link	Tags
1779576 – (CVE-2019-19334) CVE-2019-19334 libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used	CONFIRM	bugzilla.redhat.com	Issue Tracking, Patch, Third Party Advisory
[SECURITY] Fedora 31 Update: libyang-1.0.101-1.fc31 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org	Mailing List, Third Party Advisory
parser BUGFIX long identityref default value buffer overflow · CESNET/libyang@6980afa · GitHub	CONFIRM	github.com	Patch, Third Party Advisory
[SECURITY] Fedora 31 Update: libyang-1.0.101-1.fc31 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 30 Update: libyang-1.0.101-1.fc30 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
Red Hat Customer Portal	REDHAT	access.redhat.com
[SECURITY] Fedora 30 Update: libyang-1.0.101-1.fc30 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.