CVE-2014-2525

2014-03-2815:55:08

CWE-119

[email protected]

web.nvd.nist.gov

cve-2014-2525

nvd

code execution

buffer overflow

libyaml

security vulnerability

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

Low

0.707 High

EPSS

Percentile

98.1%

JSON

Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.

Affected configurations

NVD

Node

pyyamllibyamlRange≤0.1.5

pyyamllibyamlMatch0.0.1

pyyamllibyamlMatch0.1.1

pyyamllibyamlMatch0.1.2

pyyamllibyamlMatch0.1.3

pyyamllibyamlMatch0.1.4

Node

opensuseleapMatch42.1

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

CPENameOperatorVersion
pyyaml:libyamlpyyaml libyamlle0.1.5
pyyaml:libyamlpyyaml libyamleq0.0.1
pyyaml:libyamlpyyaml libyamleq0.1.1
pyyaml:libyamlpyyaml libyamleq0.1.2
pyyaml:libyamlpyyaml libyamleq0.1.3
pyyaml:libyamlpyyaml libyamleq0.1.4

CPE	Name	Operator	Version
pyyaml:libyaml	pyyaml libyaml	le	0.1.5
pyyaml:libyaml	pyyaml libyaml	eq	0.0.1
pyyaml:libyaml	pyyaml libyaml	eq	0.1.1
pyyaml:libyaml	pyyaml libyaml	eq	0.1.2
pyyaml:libyaml	pyyaml libyaml	eq	0.1.3
pyyaml:libyaml	pyyaml libyaml	eq	0.1.4