What’s Vulnerable › Vulnerabilities

CVE-2014-2525

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-03-28 · updated 2026-06-17
• Weakness: CWE-119

Description

Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.

Affected products

• openSUSE Leap: 42.1
• Opensuse: 13.1, 13.2
• Pyyaml Libyaml: through 0.1.5; 0.0.1, 0.1.1, 0.1.2, 0.1.3, 0.1.4

References

• http://advisories.mageia.org/MGASA-2014-0150.html
• http://lists.opensuse.org/opensuse-updates/2014-04/msg00022.html
• http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00050.html
• http://rhn.redhat.com/errata/RHSA-2014-0353.html
• http://rhn.redhat.com/errata/RHSA-2014-0354.html
• http://rhn.redhat.com/errata/RHSA-2014-0355.html
• http://secunia.com/advisories/57836
• http://secunia.com/advisories/57966
• http://secunia.com/advisories/57968
• http://support.apple.com/kb/HT6443
• http://www.debian.org/security/2014/dsa-2884

Get alerted when CVE-2014-2525 or the next vulnerability affects your stack