Patchwire CVEs, their patch status, and feeds to follow them

CVE-2014-2525

Fixed in a distro release EPSS 9%

Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.

Published 2014-03-28 · CVE record · OSV

Products: pyyaml libyaml, opensuse leap, opensuse

Distro releases

ReleasePackageFixed in
Debian 12libyaml0.1.4-3.2
Debian 12libyaml-libyaml-perl0.41-5
Debian 13libyaml0.1.4-3.2
Debian 13libyaml-libyaml-perl0.41-5
Debian 14libyaml0.1.4-3.2
Debian 14libyaml-libyaml-perl0.41-5
Debian 6.0libyaml0.1.3-1+deb6u4
Debian 6.0libyaml-libyaml-perl0.33-1+squeeze3
Debian 7libyaml0.1.4-2+deb7u4
Debian 7libyaml-libyaml-perl0.38-3+deb7u2
Red Hat openstack 3libyaml0:0.1.3-1.4.el6
Red Hat openstack 3libyaml-debuginfo0:0.1.3-1.4.el6
Red Hat openstack 3libyaml-devel0:0.1.3-1.4.el6
Red Hat openstack 3ruby193-libyaml0:0.1.4-5.1.el6
Red Hat openstack 3ruby193-libyaml-debuginfo0:0.1.4-5.1.el6
Red Hat openstack 3ruby193-libyaml-devel0:0.1.4-5.1.el6
Red Hat openstack 4libyaml0:0.1.3-1.4.el6
Red Hat openstack 4libyaml-debuginfo0:0.1.3-1.4.el6
Red Hat openstack 4libyaml-devel0:0.1.3-1.4.el6
Red Hat rhel common 6libyaml0:0.1.3-1.4.el6
Red Hat rhel common 6libyaml-debuginfo0:0.1.3-1.4.el6
Red Hat rhel common 6libyaml-devel0:0.1.3-1.4.el6
Red Hat rhel software collections 1ruby193-libyaml0:0.1.4-5.1.el6
Red Hat rhel software collections 1ruby193-libyaml-debuginfo0:0.1.4-5.1.el6
Red Hat rhel software collections 1ruby193-libyaml-devel0:0.1.4-5.1.el6
SUSE Linux Enterprise Desktop 12perl-YAML-LibYAML0.38-10.1
SUSE Linux Enterprise Server 12perl-YAML-LibYAML0.38-10.1
SUSE Linux Enterprise Server for SAP Applications 12perl-YAML-LibYAML0.38-10.1
openSUSE Tumbleweedlibyaml0.1.6-4.8
openSUSE Tumbleweedperl-YAML-LibYAML0.59-2.11