CVE:CVE-2013-6393
CNNVD:CNNVD-201402-076
LibYAML是Kirill Simonov程序员所研发的一个用于解析YAML 1.1数据的C语言包。
LibYAML 0.1.4及之前的版本中的scanner.c文件中的‘yaml_parser_scan_tag_uri’函数中存在基于堆的缓冲区溢出漏洞。当解析YAML标签时，远程攻击者可通过特制的YAML文档利用该漏洞造成拒绝服务（应用程序崩溃），也可能执行任意代码。
solution:Upgrade pyyaml libyaml to a higher version than 0.1.4,0.0.1,0.1.1,0.1.2,0.1.3,and avoid the version (,0.1.4],0.0.1,0.1.1,0.1.2,0.1.3; Upgrade canonical ubuntu_linux to a higher version than 12.04,12.10,13.10,and avoid the version 12.04,12.10,13.10; Upgrade redhat openstack to a higher version than 3.0,4.0,and avoid the version 3.0,4.0; Upgrade debian debian_linux to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade opensuse leap to a higher version than 42.1,and avoid the version 42.1; Upgrade opensuse opensuse to a higher version than 11.4,13.1,13.2,and avoid the version 11.4,13.1,13.2