CVE:CVE-2014-2525
CNNVD:CNNVD-201403-537
LibYAML是Kirill Simonov程序员所研发的一个用于解析YAML 1.1数据的C语言包。
LibYAML 0.1.6之前版本中的‘yaml_parser_scan_uri_escapes’函数存在基于堆的缓冲区溢出漏洞。攻击者可借助YAML文件的URI中长的percent-encoded字符序列利用该漏洞执行任意代码。
solution:Upgrade pyyaml libyaml to a higher version than 0.1.5,0.0.1,0.1.1,0.1.2,0.1.3,0.1.4,and avoid the version (,0.1.5],0.0.1,0.1.1,0.1.2,0.1.3,0.1.4; Upgrade opensuse leap to a higher version than 42.1,and avoid the version 42.1; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2