Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Note | — | Upgrade macOS to the latest versionApply OS X security update 2014-004 | Aug 28, 2015 | Mar 28, 2014 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Sep 22, 2014 | Mar 28, 2014 |
| Debian | — | Upgrade libyaml-libyaml-perlUpgrade libyaml | Jul 30, 2024 | Mar 28, 2014 |
| Freebsd | — | Upgrade mingw32-libyamlUpgrade libyaml | Dec 10, 2025 | Mar 26, 2014 |
| Gentoo Linux | — | Upgrade dev-libs/libyaml. | Oct 30, 2017 | Mar 28, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 27, 2014 |
| Suse | — | Upgrade libyaml-0-2Upgrade libyaml-develUpgrade perl-YAML-LibYAML | Dec 18, 2015 | Mar 27, 2014 |
| Ubuntu | — | Upgrade libyaml-libyaml-perlUpgrade libyaml-0-2 | Nov 8, 2024 | Mar 28, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub