Executive Summary

Informations
Name CVE-2014-9130 First vendor Publication 2014-12-08
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9130

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:28301
 
Oval ID: oval:org.mitre.oval:def:28301
Title: DSA-3103-1 -- libyaml-libyaml-perl security update
Description: Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in LibYAML, a fast YAML 1.1 parser and emitter library. An attacker able to load specially crafted YAML input into an application using libyaml could cause the application to crash.
Family: unix Class: patch
Reference(s): DSA-3103-1
CVE-2014-9130
 Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
 Product(s): libyaml-libyaml-perl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28553
 
Oval ID: oval:org.mitre.oval:def:28553
Title: DSA-3102-1 -- libyaml security update
Description: Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in LibYAML, a fast YAML 1.1 parser and emitter library. An attacker able to load specially crafted YAML input into an application using libyaml could cause the application to crash.
Family: unix Class: patch
Reference(s): DSA-3102-1
CVE-2014-9130
 Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
 Product(s): libyaml
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28648
 
Oval ID: oval:org.mitre.oval:def:28648
Title: DSA-3115-1 -- pyyaml security update
Description: Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in Python-YAML, a YAML parser and emitter for Python. An attacker able to load specially crafted YAML input into an application using python-yaml could cause the application to crash.
Family: unix Class: patch
Reference(s): DSA-3115-1
CVE-2014-9130
 Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
 Product(s): pyyaml
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2

Nessus® Vulnerability Scanner

Date Description
2016-04-18 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-473.nasl - Type : ACT_GATHER_INFO
2015-05-28 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-0953-2.nasl - Type : ACT_GATHER_INFO
2015-05-28 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-0953-1.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-0013-1.nasl - Type : ACT_GATHER_INFO
2015-04-22 Name : The remote Fedora host is missing a security update.
File : fedora_2015-5618.nasl - Type : ACT_GATHER_INFO
2015-04-07 Name : The remote Fedora host is missing a security update.
File : fedora_2015-4642.nasl - Type : ACT_GATHER_INFO
2015-04-07 Name : The remote Fedora host is missing a security update.
File : fedora_2015-4477.nasl - Type : ACT_GATHER_INFO
2015-03-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-127.nasl - Type : ACT_GATHER_INFO
2015-03-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-110.nasl - Type : ACT_GATHER_INFO
2015-03-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-109.nasl - Type : ACT_GATHER_INFO
2015-03-19 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-060.nasl - Type : ACT_GATHER_INFO
2015-02-20 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-162.nasl - Type : ACT_GATHER_INFO
2015-02-13 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2015-482.nasl - Type : ACT_GATHER_INFO
2015-02-13 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2015-481.nasl - Type : ACT_GATHER_INFO
2015-01-29 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2015-0100.nasl - Type : ACT_GATHER_INFO
2015-01-29 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20150128_libyaml_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2015-01-29 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2015-0100.nasl - Type : ACT_GATHER_INFO
2015-01-29 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2015-0100.nasl - Type : ACT_GATHER_INFO
2015-01-13 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2461-3.nasl - Type : ACT_GATHER_INFO
2015-01-13 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2461-2.nasl - Type : ACT_GATHER_INFO
2015-01-13 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2461-1.nasl - Type : ACT_GATHER_INFO
2014-12-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3115.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3102.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-765.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-242.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-16266.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-16210.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-16143.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-16132.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-16130.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Fedora host is missing a security update.
File : fedora_2014-16073.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3103.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://advisories.mageia.org/MGASA-2014-0508.html
http://linux.oracle.com/errata/ELSA-2015-0100.html
http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html
http://lists.opensuse.org/opensuse-updates/2016-04/msg00050.html
http://rhn.redhat.com/errata/RHSA-2015-0100.html
http://rhn.redhat.com/errata/RHSA-2015-0112.html
http://rhn.redhat.com/errata/RHSA-2015-0260.html
http://secunia.com/advisories/59947
http://secunia.com/advisories/60944
http://secunia.com/advisories/62164
http://secunia.com/advisories/62174
http://secunia.com/advisories/62176
http://secunia.com/advisories/62705
http://secunia.com/advisories/62723
http://secunia.com/advisories/62774
http://www.debian.org/security/2014/dsa-3102
http://www.debian.org/security/2014/dsa-3103
http://www.debian.org/security/2014/dsa-3115
http://www.mandriva.com/security/advisories?name=MDVSA-2014:242
http://www.mandriva.com/security/advisories?name=MDVSA-2015:060
http://www.openwall.com/lists/oss-security/2014/11/28/1
http://www.openwall.com/lists/oss-security/2014/11/28/8
http://www.openwall.com/lists/oss-security/2014/11/29/3
http://www.securityfocus.com/bid/71349
http://www.ubuntu.com/usn/USN-2461-1
http://www.ubuntu.com/usn/USN-2461-2
http://www.ubuntu.com/usn/USN-2461-3
https://bitbucket.org/xi/libyaml/commits/2b9156756423e967cfd09a61d125d883fca6...
https://bitbucket.org/xi/libyaml/issue/10/wrapped-strings-cause-assert-failure
https://exchange.xforce.ibmcloud.com/vulnerabilities/99047
https://puppet.com/security/cve/cve-2014-9130
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Date Informations
2024-11-28 12:43:46
  • Multiple Updates
2021-05-04 12:35:05
  • Multiple Updates
2021-04-22 01:42:44
  • Multiple Updates
2020-05-23 00:42:54
  • Multiple Updates
2017-12-09 09:22:20
  • Multiple Updates
2017-09-08 09:23:15
  • Multiple Updates
2017-01-03 09:23:01
  • Multiple Updates
2016-07-29 09:24:26
  • Multiple Updates
2016-04-19 13:30:03
  • Multiple Updates
2015-05-29 13:27:49
  • Multiple Updates
2015-05-21 13:31:54
  • Multiple Updates
2015-04-23 13:30:32
  • Multiple Updates
2015-04-08 13:29:15
  • Multiple Updates
2015-03-27 13:28:49
  • Multiple Updates
2015-03-26 09:26:52
  • Multiple Updates
2015-03-20 13:28:54
  • Multiple Updates
2015-03-18 09:28:16
  • Multiple Updates
2015-02-27 09:24:21
  • Multiple Updates
2015-02-24 09:23:54
  • Multiple Updates
2015-02-21 13:24:16
  • Multiple Updates
2015-02-14 13:23:50
  • Multiple Updates
2015-02-13 17:22:55
  • Multiple Updates
2015-02-12 00:22:40
  • Multiple Updates
2015-02-06 09:23:09
  • Multiple Updates
2015-01-30 13:24:23
  • Multiple Updates
2015-01-14 13:23:29
  • Multiple Updates
2014-12-31 13:26:14
  • Multiple Updates
2014-12-23 21:25:47
  • Multiple Updates
2014-12-16 13:25:39
  • Multiple Updates
2014-12-09 17:25:10
  • Multiple Updates
2014-12-08 21:27:29
  • First insertion