Critical severityNVD Advisory· Published Feb 6, 2014· Updated Jun 17, 2026
CVE-2013-6393
CVE-2013-6393
Description
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
libyamlnpm | < 0.2.3 | 0.2.3 |
Affected products
22cpe:2.3:a:pyyaml:libyaml:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:pyyaml:libyaml:*:*:*:*:*:*:*:*range: <=0.1.4
- cpe:2.3:a:pyyaml:libyaml:0.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:pyyaml:libyaml:0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:pyyaml:libyaml:0.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:pyyaml:libyaml:0.1.3:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
- ghsa-coords6 versionspkg:npm/libyamlpkg:rpm/opensuse/libyaml&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/perl-YAML-LibYAML&distro=openSUSE%20Tumbleweedpkg:rpm/suse/perl-YAML-LibYAML&distro=SUSE%20Linux%20Enterprise%20Desktop%2012pkg:rpm/suse/perl-YAML-LibYAML&distro=SUSE%20Linux%20Enterprise%20Server%2012pkg:rpm/suse/perl-YAML-LibYAML&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012
< 0.2.3+ 5 more
- (no CPE)range: < 0.2.3
- (no CPE)range: < 0.1.6-4.8
- (no CPE)range: < 0.59-2.11
- (no CPE)range: < 0.38-10.1
- (no CPE)range: < 0.38-10.1
- (no CPE)range: < 0.38-10.1
Patches
Vulnerability mechanics
References
28- bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchWEB
- advisories.mageia.org/MGASA-2014-0040.htmlnvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2014-02/msg00064.htmlnvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2014-02/msg00065.htmlnvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2015-02/msg00078.htmlnvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2016-04/msg00050.htmlnvdThird Party AdvisoryWEB
- rhn.redhat.com/errata/RHSA-2014-0353.htmlnvdThird Party AdvisoryWEB
- rhn.redhat.com/errata/RHSA-2014-0354.htmlnvdThird Party AdvisoryWEB
- rhn.redhat.com/errata/RHSA-2014-0355.htmlnvdThird Party AdvisoryWEB
- www.debian.org/security/2014/dsa-2850nvdThird Party AdvisoryWEB
- www.debian.org/security/2014/dsa-2870nvdThird Party AdvisoryWEB
- www.mandriva.com/security/advisoriesnvdThird Party Advisory
- www.securityfocus.com/bid/65258nvdThird Party AdvisoryVDB Entry
- www.ubuntu.com/usn/USN-2098-1nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-m75h-cghq-c8h5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-6393ghsaADVISORY
- support.apple.com/kb/HT6536nvdThird Party AdvisoryWEB
- archives.neohapsis.com/archives/bugtraq/2014-04/0134.htmlnvdBroken LinkWEB
- archives.neohapsis.com/archives/bugtraq/2014-10/0103.htmlnvdBroken LinkWEB
- cve.mitre.org/cgi-bin/cvename.cgighsaWEB
- bitbucket.org/xi/libyaml/commits/bce8b60f0b9af69fa9fab3093d0a41ba243de048ghsaWEB
- bitbucket.org/xi/libyaml/commits/tag/0.1.5nvdIssue TrackingWEB
- bugzilla.redhat.com/attachment.cginvdIssue TrackingWEB
- puppet.com/security/cve/cve-2013-6393nvdWEB
- web.archive.org/web/20140302205713/http://www.securityfocus.com/bid/65258ghsaWEB
- web.archive.org/web/20150523055002/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:060/ghsaWEB
- www.npmjs.com/advisories/21ghsaWEB
- osvdb.org/102716nvd
News mentions
0No linked articles in our index yet.