CVE-2013-6393: Buffer Overflow
A heap-based buffer overflow flaw was found in the way libyaml parsed YAML tags. A remote attacker could provide a specially-crafted YAML document that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Other sources
The yamlparserscantaguri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
Versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier. As such, they are affected by a heap-based buffer overflow vulnerability that may result in a crash or arbitrary code execution when parsing YAML tags.
Recommendation
- Update to version 0.2.3 that includes a version of LibYAML that contains a fix for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/libyamlto a version that resolves this vulnerability.Fixed in 0.2.3 - Upgrade
Upgrade
redhat/libyamlto a version that resolves this vulnerability.Fixed in 0.1.5 - Upgrade
Upgrade
LibYAMLto a version that resolves this vulnerability.Fixed in 0.2.3 - Compensating control
If you cannot update, note that versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier, which are affected—reduce exposure by limiting/isolating YAML processing for untrusted input until the update to LibYAML 0.2.3 is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6393?
CVE-2013-6393 has a high severity rating due to its potential for remote code execution.
How do I fix CVE-2013-6393?
To fix CVE-2013-6393, upgrade libyaml to version 0.1.5 or higher.
What systems are affected by CVE-2013-6393?
CVE-2013-6393 affects various systems, including certain versions of Ubuntu, Debian, and OpenSUSE that utilize vulnerable libyaml versions.
What are the risks associated with CVE-2013-6393?
The risks of CVE-2013-6393 include application crashes and potential arbitrary code execution by an attacker.
Is CVE-2013-6393 still a concern today?
While CVE-2013-6393 is an older vulnerability, it remains a concern for systems that have not been updated and still use the vulnerable versions of libyaml.