Security update for perl-YAML-LibYAML
SUSE Patch
security@suse.de
SUSE Security Team
SUSE-SU-2015:0953-1
Final
1
1
2015-02-10T14:18:22Z
current
2015-02-10T14:18:22Z
2015-02-10T14:18:22Z
cve-database/bin/generate-cvrf.pl
2017-02-24T01:00:00Z
Security update for perl-YAML-LibYAML
perl-YAML-LibYAML was updated to fix three security issues.
These security issues were fixed:
- CVE-2013-6393: The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performed an incorrect cast, which allowed remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggered a heap-based buffer overflow (bnc#860617, bnc#911782).
- CVE-2014-9130: scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allowed context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping (bnc#907809, bnc#911782).
- CVE-2014-2525: Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allowed context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file (bnc#868944, bnc#911782).
The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
SUSE-SLE-SERVER-12-2015-215
Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)
https://www.suse.com/support/update/announcement/2015/suse-su-20150953-1/
Link for SUSE-SU-2015:0953-1
https://lists.suse.com/pipermail/sle-security-updates/2015-May/001411.html
E-Mail link for SUSE-SU-2015:0953-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/860617
SUSE Bug 860617
https://bugzilla.suse.com/868944
SUSE Bug 868944
https://bugzilla.suse.com/907809
SUSE Bug 907809
https://bugzilla.suse.com/911782
SUSE Bug 911782
https://www.suse.com/security/cve/CVE-2013-6393/
SUSE CVE CVE-2013-6393 page
https://www.suse.com/security/cve/CVE-2014-2525/
SUSE CVE CVE-2014-2525 page
https://www.suse.com/security/cve/CVE-2014-9130/
SUSE CVE CVE-2014-9130 page
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
perl-YAML-LibYAML-0.38-10.1
perl-YAML-LibYAML-0.38-10.1 as a component of SUSE Linux Enterprise Server 12
perl-YAML-LibYAML-0.38-10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
CVE-2013-6393
SUSE Linux Enterprise Server 12:perl-YAML-LibYAML-0.38-10.1
SUSE Linux Enterprise Server for SAP Applications 12:perl-YAML-LibYAML-0.38-10.1
moderate
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
https://www.suse.com/support/update/announcement/2015/suse-su-20150953-1/
https://www.suse.com/security/cve/CVE-2013-6393.html
CVE-2013-6393
https://bugzilla.suse.com/860617
SUSE Bug 860617
https://bugzilla.suse.com/911782
SUSE Bug 911782
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
CVE-2014-2525
SUSE Linux Enterprise Server 12:perl-YAML-LibYAML-0.38-10.1
SUSE Linux Enterprise Server for SAP Applications 12:perl-YAML-LibYAML-0.38-10.1
moderate
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
https://www.suse.com/support/update/announcement/2015/suse-su-20150953-1/
https://www.suse.com/security/cve/CVE-2014-2525.html
CVE-2014-2525
https://bugzilla.suse.com/868944
SUSE Bug 868944
https://bugzilla.suse.com/911782
SUSE Bug 911782
scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.
CVE-2014-9130
SUSE Linux Enterprise Server 12:perl-YAML-LibYAML-0.38-10.1
SUSE Linux Enterprise Server for SAP Applications 12:perl-YAML-LibYAML-0.38-10.1
moderate
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
https://www.suse.com/support/update/announcement/2015/suse-su-20150953-1/
https://www.suse.com/security/cve/CVE-2014-9130.html
CVE-2014-9130
https://bugzilla.suse.com/907809
SUSE Bug 907809
https://bugzilla.suse.com/911782
SUSE Bug 911782
https://bugzilla.suse.com/921588
SUSE Bug 921588