Critical severityNVD Advisory· Published Feb 6, 2014· Updated Apr 29, 2026
CVE-2013-6393
CVE-2013-6393
Description
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
libyamlnpm | < 0.2.3 | 0.2.3 |
Affected products
16cpe:2.3:a:pyyaml:libyaml:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:pyyaml:libyaml:*:*:*:*:*:*:*:*range: <=0.1.4
- cpe:2.3:a:pyyaml:libyaml:0.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:pyyaml:libyaml:0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:pyyaml:libyaml:0.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:pyyaml:libyaml:0.1.3:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
28- bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchWEB
- advisories.mageia.org/MGASA-2014-0040.htmlnvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2014-02/msg00064.htmlnvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2014-02/msg00065.htmlnvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2015-02/msg00078.htmlnvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2016-04/msg00050.htmlnvdThird Party AdvisoryWEB
- rhn.redhat.com/errata/RHSA-2014-0353.htmlnvdThird Party AdvisoryWEB
- rhn.redhat.com/errata/RHSA-2014-0354.htmlnvdThird Party AdvisoryWEB
- rhn.redhat.com/errata/RHSA-2014-0355.htmlnvdThird Party AdvisoryWEB
- www.debian.org/security/2014/dsa-2850nvdThird Party AdvisoryWEB
- www.debian.org/security/2014/dsa-2870nvdThird Party AdvisoryWEB
- www.mandriva.com/security/advisoriesnvdThird Party Advisory
- www.securityfocus.com/bid/65258nvdThird Party AdvisoryVDB Entry
- www.ubuntu.com/usn/USN-2098-1nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-m75h-cghq-c8h5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-6393ghsaADVISORY
- support.apple.com/kb/HT6536nvdThird Party AdvisoryWEB
- archives.neohapsis.com/archives/bugtraq/2014-04/0134.htmlnvdBroken LinkWEB
- archives.neohapsis.com/archives/bugtraq/2014-10/0103.htmlnvdBroken LinkWEB
- cve.mitre.org/cgi-bin/cvename.cgighsaWEB
- bitbucket.org/xi/libyaml/commits/bce8b60f0b9af69fa9fab3093d0a41ba243de048ghsaWEB
- bitbucket.org/xi/libyaml/commits/tag/0.1.5nvdIssue TrackingWEB
- bugzilla.redhat.com/attachment.cginvdIssue TrackingWEB
- puppet.com/security/cve/cve-2013-6393nvdWEB
- web.archive.org/web/20140302205713/http://www.securityfocus.com/bid/65258ghsaWEB
- web.archive.org/web/20150523055002/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:060/ghsaWEB
- www.npmjs.com/advisories/21ghsaWEB
- osvdb.org/102716nvd
News mentions
0No linked articles in our index yet.