[Forgot Password]
Login  Register Subscribe

30480

 
 

423868

 
 

251782

 
 

909

 
 

196543

 
 

282

Paid content will be excluded from the download.


Download | Alert*
OVAL

DSA-2850-2 libyaml -- regression

ID: oval:org.secpod.oval:def:601213Date: (C)2014-02-19   (M)2022-10-10
Class: PATCHFamily: unix




The security update released in DSA-2850-1 for libyaml introduced a regression in libyaml failing to parse a subset of valid yaml documents. For reference the original advisory text follows. Florian Weimer of the Red Hat Product Security Team discovered a heap-based buffer overflow flaw in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a YAML document with a specially-crafted tag that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

Platform:
Debian 7.0
Debian 6.0
Product:
libyaml-0-2
Reference:
DSA-2850-2
CPE    3
cpe:/a:pyyaml:libyaml-0-2
cpe:/o:debian:debian_linux:6.0
cpe:/o:debian:debian_linux:7.0

© SecPod Technologies