Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 499920 (CVE-2013-6393)

Summary: <dev-libs/libyaml-0.1.5 : buffer overflow (CVE-2013-6393)
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: radhermit
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://www.openwall.com/lists/oss-security/2014/01/31/1
Whiteboard: B2 [glsa]
Package list:
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2014-01-31 19:51:59 UTC
From ${URL} :

Florian Weimer of the Red Hat Product Security Team discovered a heap
based buffer overflow due to integer misuse maybe triggered when parsing
large yaml documents.

This issue has been assigned CVE-2013-6393.

https://bugzilla.redhat.com/show_bug.cgi?id=1033990


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Tim Harder gentoo-dev 2014-02-07 07:30:54 UTC
Arches go ahead.
Comment 2 Jeroen Roovers gentoo-dev 2014-02-07 14:00:48 UTC
Stable for HPPA.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2014-02-07 20:55:35 UTC
CVE-2013-6393 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6393):
  The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5
  performs an incorrect cast, which allows remote attackers to cause a denial
  of service (application crash) and possibly execute arbitrary code via
  crafted tags in a YAML document, which triggers a heap-based buffer
  overflow.
Comment 4 Akinori Hattori gentoo-dev 2014-02-08 13:19:27 UTC
ia64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2014-02-08 19:47:47 UTC
amd64 stable
Comment 6 PaweĊ‚ Hajdan, Jr. (RETIRED) gentoo-dev 2014-02-09 06:57:50 UTC
x86 stable
Comment 7 Agostino Sarubbo gentoo-dev 2014-02-09 08:19:09 UTC
ppc stable
Comment 8 Agostino Sarubbo gentoo-dev 2014-02-09 08:23:55 UTC
ppc64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2014-02-09 08:27:12 UTC
sparc stable
Comment 10 Agostino Sarubbo gentoo-dev 2014-02-16 07:35:10 UTC
alpha stable
Comment 11 Agostino Sarubbo gentoo-dev 2014-02-17 21:08:12 UTC
arm stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 12 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2014-02-18 09:38:18 UTC
glsa request filed.
Comment 13 Sergey Popov gentoo-dev 2014-02-27 14:29:32 UTC
+  27 Feb 2014; Sergey Popov <pinkbyte@gentoo.org> -libyaml-0.1.4.ebuild:
+  Security cleanup, wrt bug #499920
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2014-03-08 18:50:23 UTC
This issue was resolved and addressed in
 GLSA 201403-02 at http://security.gentoo.org/glsa/glsa-201403-02.xml
by GLSA coordinator Mikle Kolyada (Zlogene).