Bugzilla – Bug 860617
VUL-0: CVE-2013-6393: libyaml: heap based buffer overflow due to integer misuse
Last modified: 2016-04-17 15:08:10 UTC
CRD: Jan 27th 2014 after 1600 UTC. > This is a heads-up on an embargoed security issue in libyaml found by > Florian Weimer of the Red Hat Product Security Team. > > This issue can be considered public on Jan 27th 2014 after 1600 UTC. > > A heap based buffer overflow due to integer misuse maybe triggered when > parsing large yaml documents. > > Please see the attached patches for details.
Created attachment 575985 [details] CVE-2013-6393-string-overflow.patch
Created attachment 575987 [details] CVE-2013-6393-node-id-hardening.patch
Created attachment 575988 [details] CVE-2013-6393-indent-column-overflow.patch
libyaml lives inside the SDK so only openSUSE seems to be affected. I couldn't find Cristian Rodriguez inside the Novell phonebook so I've added his opensuse.org address to the CC list.
Created attachment 576077 [details] Updated libyaml-indent-column-overflow.patch
bugbot adjusting priority
I've already submitted the fixes for openSUSE 12.3 and 13.1
This is an autogenerated message for OBS integration: This bug (860617) was mentioned in https://build.opensuse.org/request/show/221258 12.3 / libyaml https://build.opensuse.org/request/show/221259 13.1 / libyaml
This is an autogenerated message for OBS integration: This bug (860617) was mentioned in https://build.opensuse.org/request/show/221285 Factory / libyaml
The SWAMPID for this issue is 56289. This issue was rated as moderate. Please submit fixed packages until 2014-03-05. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
openSUSE-SU-2014:0272-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 860617 CVE References: CVE-2013-6393 Sources used: openSUSE 13.1 (src): libyaml-0.1.4-2.4.1 openSUSE 12.3 (src): libyaml-0.1.3-11.4.1
openSUSE-SU-2014:0273-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 860617 CVE References: CVE-2013-6393 Sources used: openSUSE 11.4 (src): libyaml-0.1.3-6.1
QA spotted this redhat bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6393 Original report from Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738587 === The patch libyaml-indent-column-overflow-v2.patch applied for the update to address CVE-2013-6393 introduces a regression which can be seen when parsing a small YAML sample file with the tests/run-parser.c utility: ----cut---------cut---------cut---------cut---------cut---------cut----- %YAML 1.1 --- # Indented Block name: John Smith age: 33 --- # Inline Block {name: John Smith, age: 33} ----cut---------cut---------cut---------cut---------cut---------cut----- Compiling run-parser.c in the source and run against this YAML file leads with the patch applied to: # ./run-parser ./regression.yaml [1] Parsing './regression.yaml': FAILURE (9 events) Upstream indeed has addressed this part slightly different, with [1] and [2]. [1] https://bitbucket.org/xi/libyaml/commits/f859ed1eb757a3562b98a28a8ce69274bfd4b3f2 [2] https://bitbucket.org/xi/libyaml/commits/af3599437a87162554787c52d8b16eab553f537b ===
Jordi, the udpate was rejected ... can you redo the packages ... perhaps with the upstream fix now instead of the other one?
openSUSE-SU-2014:0381-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 860617 CVE References: CVE-2013-6393 Sources used: openSUSE 13.1 (src): libyaml-0.1.4-2.8.1 openSUSE 12.3 (src): libyaml-0.1.3-11.8.1
Update released for: libyaml-0-2 Products: SLE-STUDIOONSITE 1.3 (x86_64) SUSE-MANAGER 1.7 (x86_64)
SUSE-SU-2014:0403-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 860617 CVE References: CVE-2013-6393 Sources used: SUSE Studio Onsite 1.3 (src): libyaml-0.1.3-0.10.10.1 SUSE Manager 1.7 for SLE 11 SP2 (src): libyaml-0.1.3-0.10.10.1
Affected packages: SLE-11-SP2-PRODUCTS: libyaml
The SWAMPID for this issue is 56726. This issue was rated as moderate. Please submit fixed packages until 2014-04-03. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Update released for: libyaml, libyaml-0-2 Products: SUSE-CLOUD 3.0 (x86_64)
Update released for: libyaml, libyaml-0-2, libyaml-debuginfo, libyaml-debugsource, libyaml-devel Products: SLE-STUDIOONSITE 1.3 (x86_64) SUSE-MANAGER 1.7 (x86_64)
SUSE-SU-2014:0456-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 860617,868944 CVE References: CVE-2013-6393,CVE-2014-2525 Sources used: SUSE Studio Onsite 1.3 (src): libyaml-0.1.3-0.10.12.1 SUSE Manager 1.7 for SLE 11 SP2 (src): libyaml-0.1.3-0.10.12.1 SUSE Cloud 3 (src): libyaml-0.1.3-0.10.12.1
This is an autogenerated message for OBS integration: This bug (860617) was mentioned in https://build.opensuse.org/request/show/228178 Factory / libyaml
This is an autogenerated message for OBS integration: This bug (860617) was mentioned in https://build.opensuse.org/request/show/285086 13.2+13.1 / perl-YAML-LibYAML
openSUSE-SU-2015:0319-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 751503,860617,868944,907809,911782 CVE References: CVE-2012-1152,CVE-2013-6393,CVE-2014-2525,CVE-2014-9130 Sources used: openSUSE 13.2 (src): perl-YAML-LibYAML-0.59-2.4.1 openSUSE 13.1 (src): perl-YAML-LibYAML-0.59-6.4.1
SUSE-SU-2015:0953-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 860617,868944,907809,911782 CVE References: CVE-2013-6393,CVE-2014-2525,CVE-2014-9130 Sources used: SUSE Linux Enterprise Server 12 (src): perl-YAML-LibYAML-0.38-10.1
SUSE-SU-2015:0953-2: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 860617,868944,907809,911782 CVE References: CVE-2013-6393,CVE-2014-2525,CVE-2014-9130 Sources used: SUSE Linux Enterprise Server 12 (src): perl-YAML-LibYAML-0.38-10.1 SUSE Linux Enterprise Desktop 12 (src): perl-YAML-LibYAML-0.38-10.1
openSUSE-SU-2016:1067-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 860617,868944,907809,911782 CVE References: CVE-2013-6393,CVE-2014-2525,CVE-2014-9130 Sources used: openSUSE Leap 42.1 (src): perl-YAML-LibYAML-0.38-4.1