Buffer overflow in Pyyaml Libyaml
CVE-2014-2525
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
Vulnerability class: Buffer Overflow
EPSS: 0.619 (98.4th percentile) — read the EPSS interpretation.
Affected products
- Pyyaml Libyaml — versions 0.0.1, 0.1.1, 0.1.2
- Opensuse Leap — versions 42.1
- Opensuse — versions 13.1, 13.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 66478 (vdb-entry, x_refsource_BID)
- 57836 (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- MDVSA-2015:060 (vendor-advisory, x_refsource_MANDRIVA)
- cve@mitre.org (US Government Resource, x_refsource_MISC)
- DSA-2885 (vendor-advisory, x_refsource_DEBIAN)
- USN-2160-1 (x_refsource_UBUNTU, vendor-advisory)
- openSUSE-SU-2015:0319 (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- RHSA-2014:0355 (x_refsource_REDHAT, vendor-advisory)
- DSA-2884 (vendor-advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2014-2525?
- CVE-2014-2525 is a vulnerability in Pyyaml Libyaml, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-03-28.
- Is CVE-2014-2525 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.