20 results · Feed
-
Medium 5.3
libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via l…
-
Medium 6.5
libyang - Heap Use-After-Free Write in XML Metadata Parsing
libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly updates metadata list pointers when freeing non-head default metadata entries. Attackers can trigger this vulnerability by submitting crafted…
-
High 7.5
libyang: lyb_read_string() integer overflow → heap buffer overflow
libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciously crafted LYB binary blob. An attacker who can supply LYB …
-
High 7.5
libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_valida…
-
Unscored —
libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at…
-
Unscored —
In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In so…
-
Unscored —
In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in som…
-
Unscored —
In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revisio…
-
Unscored —
A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_e…
-
Unscored —
In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. …
-
Unscored —
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-f…
-
Unscored —
An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-f…
-
Unscored —
A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notific…
-
Unscored —
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applica…
-
Unscored —
A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a…
-
Unscored —
A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during …
-
Unscored —
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminat…
-
Unscored —
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafre…
-
High 8.1
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG f…
-
High 8.1
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG f…