Input validation error - CVE-2014-9130

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33057

Input validation error - CVE-2014-9130

Published: December 8, 2014 / Updated: August 3, 2020


Vulnerability identifier: #VU33057
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-9130
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.


Affected software

Amazon Linux AMI
Fedora
yaml (Alpine package)
wireshark (Alpine package)
libyaml
perl-YAML-LibYAML
PyYAML

How to mitigate CVE-2014-9130

Install update from vendor's website.

yaml (Alpine package) - addressed in versions 0.1.6-r1, 0.1.7-r0
wireshark (Alpine package) - update to 2.0.11-r0
libyaml - addressed in versions 0.1.2-8.el5, 0.1.6-6.fc21
perl-YAML-LibYAML - addressed in versions 0.38-5.el6, 0.54-1.el7, 0.54-1.fc21
PyYAML - addressed in versions 3.09-11.el5, 3.11-7.fc21, 3.11-7.fc22

External References

Related Security Bulletins