[Forgot Password]
Login  Register Subscribe

30479

 
 

423868

 
 

250038

 
 

909

 
 

195843

 
 

282

Paid content will be excluded from the download.


Download | Alert*
OVAL

DSA-2850-2 libyaml -- regression

ID: oval:org.secpod.oval:def:601213Date: (C)2014-02-19   (M)2022-10-10
Class: PATCHFamily: unix




The security update released in DSA-2850-1 for libyaml introduced a regression in libyaml failing to parse a subset of valid yaml documents. For reference the original advisory text follows. Florian Weimer of the Red Hat Product Security Team discovered a heap-based buffer overflow flaw in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a YAML document with a specially-crafted tag that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

Platform:
Debian 7.0
Debian 6.0
Product:
libyaml-0-2
Reference:
DSA-2850-2
CPE    3
cpe:/a:pyyaml:libyaml-0-2
cpe:/o:debian:debian_linux:6.0
cpe:/o:debian:debian_linux:7.0

© SecPod Technologies