CVE-2013-6393
Fixed in a distro release EPSS 7%
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
Products: pyyaml libyaml, canonical ubuntu_linux, redhat openstack, debian_linux, opensuse leap, opensuse
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | libyaml | 0.2.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libyaml | 0.1.4-3 |
| Debian 12 | libyaml-libyaml-perl | 0.41-4 |
| Debian 13 | libyaml | 0.1.4-3 |
| Debian 13 | libyaml-libyaml-perl | 0.41-4 |
| Debian 14 | libyaml | 0.1.4-3 |
| Debian 14 | libyaml-libyaml-perl | 0.41-4 |
| Debian 6.0 | libyaml | 0.1.3-1+deb6u2 |
| Debian 6.0 | libyaml-libyaml-perl | 0.33-1+squeeze2 |
| Debian 7 | libyaml | 0.1.4-2+deb7u2 |
| Debian 7 | libyaml-libyaml-perl | 0.38-3+deb7u1 |
| Red Hat openstack 3 | libyaml | 0:0.1.3-1.4.el6 |
| Red Hat openstack 3 | libyaml-debuginfo | 0:0.1.3-1.4.el6 |
| Red Hat openstack 3 | libyaml-devel | 0:0.1.3-1.4.el6 |
| Red Hat openstack 3 | ruby193-libyaml | 0:0.1.4-5.1.el6 |
| Red Hat openstack 3 | ruby193-libyaml-debuginfo | 0:0.1.4-5.1.el6 |
| Red Hat openstack 3 | ruby193-libyaml-devel | 0:0.1.4-5.1.el6 |
| Red Hat openstack 4 | libyaml | 0:0.1.3-1.4.el6 |
| Red Hat openstack 4 | libyaml-debuginfo | 0:0.1.3-1.4.el6 |
| Red Hat openstack 4 | libyaml-devel | 0:0.1.3-1.4.el6 |
| Red Hat rhel common 6 | libyaml | 0:0.1.3-1.4.el6 |
| Red Hat rhel common 6 | libyaml-debuginfo | 0:0.1.3-1.4.el6 |
| Red Hat rhel common 6 | libyaml-devel | 0:0.1.3-1.4.el6 |
| Red Hat rhel software collections 1 | ruby193-libyaml | 0:0.1.4-5.1.el6 |
| Red Hat rhel software collections 1 | ruby193-libyaml-debuginfo | 0:0.1.4-5.1.el6 |
| Red Hat rhel software collections 1 | ruby193-libyaml-devel | 0:0.1.4-5.1.el6 |
| SUSE Linux Enterprise Desktop 12 | perl-YAML-LibYAML | 0.38-10.1 |
| SUSE Linux Enterprise Server 12 | perl-YAML-LibYAML | 0.38-10.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | perl-YAML-LibYAML | 0.38-10.1 |
| openSUSE Tumbleweed | libyaml | 0.1.6-4.8 |
| openSUSE Tumbleweed | perl-YAML-LibYAML | 0.59-2.11 |