CVE-2019-20394

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.redhat.com/show_bug.cgi?id=1793932Issue Tracking, Patch, Third Party Advisory
https://github.com/CESNET/libyang/commit/6cc51b1757dfbb7cff92de074ada65e8523289a6Patch, Third Party Advisory
https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3Third Party Advisory
https://github.com/CESNET/libyang/issues/769Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html
https://bugzilla.redhat.com/show_bug.cgi?id=1793932Issue Tracking, Patch, Third Party Advisory
https://github.com/CESNET/libyang/commit/6cc51b1757dfbb7cff92de074ada65e8523289a6Patch, Third Party Advisory
https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3Third Party Advisory
https://github.com/CESNET/libyang/issues/769Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00019.html

Timeline

Published: Jan 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-203956.5A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that CVE-2019-203966.5A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsin CVE-2019-203978.8A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that CVE-2019-203986.5A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved e CVE-2019-203995.9A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak CVE-2019-20405.0In rw_i93_process_ext_sys_info of rw_i93.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local i CVE-2019-204007.8The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global pat CVE-2019-204016.5Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet fin CVE-2019-204024.9Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without r CVE-2019-204035.3The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or n CVE-2019-204044.3The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they CVE-2019-204054.3The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring fla