Stack-based Buffer Overflow in libyang Affects Multiple Versions

CVE-2019-19333

Summary

A stack-based buffer overflow vulnerability exists in libyang prior to version 1.0-r5, triggered by improper parsing of YANG files containing a leaf of type 'bits'. When an application utilizes libyang to process untrusted YANG files, it becomes susceptible to this flaw. An attacker can exploit this vulnerability to induce a denial of service or potentially execute arbitrary code on the affected system.

References