Back to Database
Status published
Medium
CVE-2013-6393
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs...
Vulnerability Description
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-6393
Credits & Attribution
No credits recorded in the NVD database.
References
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00065.html
- http://www.debian.org/security/2014/dsa-2870
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1033990
- http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
- http://osvdb.org/102716
- https://bugzilla.redhat.com/attachment.cgi?id=847926&action=diff
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:060
- http://www.securityfocus.com/bid/65258
- http://advisories.mageia.org/MGASA-2014-0040.html
- http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html
- http://rhn.redhat.com/errata/RHSA-2014-0355.html
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00064.html
- http://rhn.redhat.com/errata/RHSA-2014-0354.html
- https://support.apple.com/kb/HT6536
- http://lists.opensuse.org/opensuse-updates/2016-04/msg00050.html
- http://www.debian.org/security/2014/dsa-2850
- http://rhn.redhat.com/errata/RHSA-2014-0353.html
- https://bitbucket.org/xi/libyaml/commits/tag/0.1.5
- https://puppet.com/security/cve/cve-2013-6393
- http://www.ubuntu.com/usn/USN-2098-1
More from pyyaml
View All →CVE-2019-20477
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load...
Critical
9.8
CVE-2017-18342
In PyYAML before 5.1, the yaml.load() API could execute arbitrary...
Critical
9.8
CVE-2014-9130
scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the...
Medium
5
CVE-2014-2525
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before...
Medium
6.8
Affected Vendor
pyyaml
View all reports →Affected Software
libyaml, ubuntu linux, openstack, debian linux, leap, opensuse
Vulnerable Versions:
0, 0.0.1, 0.1.1, 0.1.2, 0.1.3, 12.04, 12.10, 13.10, 3.0, 4.0, 6.0, 7.0, 42.1, 11.4, 13.1, 13.2
Timeline
Official Publish:
February 6th, 2014
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.