Catalogo CVE
CVE-2014-2525
libyaml: CVE-2014-2525
- Gravità
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 8.77% · Oct 22, 2026
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libyaml | sid | 0.2.5-2 | fixed |
| Debian | libyaml | forky | 0.2.5-2 | fixed |
| Debian | libyaml | trixie | 0.2.5-2 | fixed |
| Debian | libyaml | bookworm | 0.2.5-1 | fixed |
| Debian | libyaml-libyaml-perl | sid | 0.910.0+ds-1 | fixed |
| Debian | libyaml-libyaml-perl | forky | 0.910.0+ds-1 | fixed |
| Debian | libyaml-libyaml-perl | trixie | 0.903.0+ds-1 | fixed |
| Debian | libyaml-libyaml-perl | bookworm | 0.86+ds-1+deb12u1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libyaml | source | sid | 0.1.4-3.2 | not yet assigned | Not reported | [742732] |
| Debian | libyaml | source | forky | 0.1.4-3.2 | not yet assigned | Not reported | [742732] |
| Debian | libyaml | source | trixie | 0.1.4-3.2 | not yet assigned | Not reported | [742732] |
| Debian | libyaml | source | bookworm | 0.1.4-3.2 | not yet assigned | Not reported | [742732] |
| Debian | libyaml-libyaml-perl | source | sid | 0.41-5 | not yet assigned | Not reported | Not reported |
| Debian | libyaml-libyaml-perl | source | forky | 0.41-5 | not yet assigned | Not reported | Not reported |
| Debian | libyaml-libyaml-perl | source | trixie | 0.41-5 | not yet assigned | Not reported | Not reported |
| Debian | libyaml-libyaml-perl | source | bookworm | 0.41-5 | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libyaml-0-2]Corretta
Pacchetto sorgente: [libyaml]
Dettagli (2)
0.2.5-1· amd64 · bookwormCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · bookworm; dsa · libyaml · debian · 12
0.2.5-1· arm64 · bookwormCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · bookworm; dsa · libyaml · debian · 12
- [libyaml-dev]Corretta
Pacchetto sorgente: [libyaml]
Dettagli (2)
0.2.5-1· amd64 · bookwormCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · bookworm; dsa · libyaml · debian · 12
0.2.5-1· arm64 · bookwormCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · bookworm; dsa · libyaml · debian · 12
- [libyaml-doc]Corretta
Pacchetto sorgente: [libyaml]
Dettagli (2)
0.2.5-1· all · bookwormCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · bookworm; dsa · libyaml · debian · 12
0.2.5-1· all · bookwormCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · bookworm; dsa · libyaml · debian · 12
- [libyaml-libyaml-perl]Corretta
Dettagli (2)
0.86+ds-1+deb12u1· amd64 · bookwormCorretta · Corretta:
0.41-5dsa · libyaml-libyaml-perl · debian · bookworm; dsa · libyaml-libyaml-perl · debian · 12
0.86+ds-1+deb12u1· arm64 · bookwormCorretta · Corretta:
0.41-5dsa · libyaml-libyaml-perl · debian · bookworm; dsa · libyaml-libyaml-perl · debian · 12
[Debian 13 (Trixie)]
- [libyaml-0-2]Corretta
Pacchetto sorgente: [libyaml]
Dettagli (2)
0.2.5-2· amd64 · trixieCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · 13
0.2.5-2· arm64 · trixieCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · 13
- [libyaml-dev]Corretta
Pacchetto sorgente: [libyaml]
Dettagli (2)
0.2.5-2· amd64 · trixieCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · 13
0.2.5-2· arm64 · trixieCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · 13
- [libyaml-doc]Corretta
Pacchetto sorgente: [libyaml]
Dettagli (2)
0.2.5-2· all · trixieCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · 13
0.2.5-2· all · trixieCorretta · Corretta:
0.1.4-3.2dsa · libyaml · debian · 13
- [libyaml-libyaml-perl]Corretta
Dettagli (2)
0.903.0+ds-1· amd64 · trixieCorretta · Corretta:
0.41-5dsa · libyaml-libyaml-perl · debian · 13
0.903.0+ds-1· arm64 · trixieCorretta · Corretta:
0.41-5dsa · libyaml-libyaml-perl · debian · 13
Osservato:
Riferimenti
- [https://access.redhat.com/errata/RHSA-2014:0354]
- [https://ftp.suse.com/pub/projects/security/]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2014-2525]
- [https://osv.dev/vulnerability/DSA-2884-1]
- [https://osv.dev/vulnerability/DSA-2885-1]
- [https://security-tracker.debian.org/tracker/CVE-2014-2525]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]