rpm package
suse/libyang&distro=SUSE Linux Enterprise Module for Server Applications 15 SP3
pkg:rpm/suse/libyang&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP3
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-28906 | — | < 1.0.184-150300.3.6.1 | 1.0.184-150300.3.6.1 | May 20, 2021 | In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash. | ||
| CVE-2021-28905 | — | < 1.0.184-150300.3.3.1 | 1.0.184-150300.3.3.1 | May 20, 2021 | In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617). | ||
| CVE-2021-28904 | — | < 1.0.184-150300.3.6.1 | 1.0.184-150300.3.6.1 | May 20, 2021 | In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a crash. | ||
| CVE-2021-28903 | — | < 1.0.184-150300.3.6.1 | 1.0.184-150300.3.6.1 | May 20, 2021 | A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash. | ||
| CVE-2021-28902 | — | < 1.0.184-150300.3.6.1 | 1.0.184-150300.3.6.1 | May 20, 2021 | In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash. |
- CVE-2021-28906May 20, 2021affected < 1.0.184-150300.3.6.1fixed 1.0.184-150300.3.6.1
In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.
- CVE-2021-28905May 20, 2021affected < 1.0.184-150300.3.3.1fixed 1.0.184-150300.3.3.1
In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617).
- CVE-2021-28904May 20, 2021affected < 1.0.184-150300.3.6.1fixed 1.0.184-150300.3.6.1
In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a crash.
- CVE-2021-28903May 20, 2021affected < 1.0.184-150300.3.6.1fixed 1.0.184-150300.3.6.1
A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash.
- CVE-2021-28902May 20, 2021affected < 1.0.184-150300.3.6.1fixed 1.0.184-150300.3.6.1
In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash.