CVE-2023-26916: Null Pointer Dereference
First published: Mon Apr 03 2023(Updated: )
libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cesnet Libyang | >=2.0.164<=2.1.30 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/CESNET/libyang/issues/1979
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6NQZHCJG3SBMFOQNIPRZGKDK3ARHLTTB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U2VWGCMYKQH4BTFEHX5VYEXXOPIKKFHS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6NQZHCJG3SBMFOQNIPRZGKDK3ARHLTTB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2VWGCMYKQH4BTFEHX5VYEXXOPIKKFHS/
Frequently Asked Questions
What is CVE-2023-26916?
CVE-2023-26916 is a vulnerability in libyang from version 2.0.164 to version 2.1.30 that can result in a NULL pointer dereference.
How severe is CVE-2023-26916?
CVE-2023-26916 has a severity rating of medium, with a CVSS score of 5.3.
What software is affected by CVE-2023-26916?
Cesnet Libyang versions 2.0.164 to 2.1.30, Fedora 36, and Fedora 37 are affected by CVE-2023-26916.
What is the CWE ID of CVE-2023-26916?
CVE-2023-26916 is associated with CWE ID 476.
How can CVE-2023-26916 be fixed?
To fix CVE-2023-26916, users should update their libyang software to a version that has the patch for the vulnerability.
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cesnet
- canonical/cesnet libyang
- version/cesnet libyang/2.0.164
- version/cesnet libyang/2.1.30
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37