SB2022040118 - SUSE update for yaml-cpp
Published: April 1, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2018-20573)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
2) Buffer overflow (CVE-ID: CVE-2018-20574)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
3) Buffer overflow (CVE-ID: CVE-2019-6285)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
4) Resource exhaustion (CVE-ID: CVE-2019-6292)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser, and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, HandleNode. Remote attackers could leverage this vulnerability to cause a denial-of-service via a cpp file.
Remediation
Install update from vendor's website.