Out-of-Bounds

Affecting yaml-cpp package, versions >0.0.0

Overview

yaml-cpp is a YAML parser and emitter in C++.

Affected versions of this package are vulnerable to Out-of-Bounds. The attacks are possible because the SingleDocParser::HandleNode() function does not handle YAML files properly, allowing the attackers to trigger stack consumption and application crash using malicious YAML files.

Remediation

There is no fixed version for yaml-cpp.

References

• GitHub Issue
• Security Focus