A double-free is present in libyang up to version v1.0-r1 in function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution. Upstream issue: https://github.com/CESNET/libyang/issues/739 Upstream fix: https://github.com/CESNET/libyang/commit/88bd6c548ba79bce176cd875e9b56e7e0ef4d8d4
Created libyang tracking bugs for this issue: Affects: fedora-all [bug 1797539]