What’s Vulnerable › Vulnerabilities

CVE-2013-6393

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-02-06 · updated 2026-06-17
• Weakness: CWE-119

Description

The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.

Affected products

• Canonical Ubuntu Linux: 12.04, 12.10, 13.10
• Debian Linux: 6.0, 7.0
• openSUSE Leap: 42.1
• Opensuse: 11.4, 13.1, 13.2
• Pyyaml Libyaml: through 0.1.4; 0.0.1, 0.1.1, 0.1.2, 0.1.3
• OpenStack: 3.0, 4.0

References

• http://advisories.mageia.org/MGASA-2014-0040.html
• http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html
• http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00064.html
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00065.html
• http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00050.html
• http://osvdb.org/102716
• http://rhn.redhat.com/errata/RHSA-2014-0353.html
• http://rhn.redhat.com/errata/RHSA-2014-0354.html
• http://rhn.redhat.com/errata/RHSA-2014-0355.html
• http://www.debian.org/security/2014/dsa-2850

Get alerted when CVE-2013-6393 or the next vulnerability affects your stack