[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 3492-1] yajl security update

Debian LTS Advisory DLA-3492-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                         Tobias Frost
July 11, 2023                                 https://wiki.debian.org/LTS

Package        : yajl
Version        : 2.1.0-3+deb10u2
CVE ID         : CVE-2017-16516 CVE-2022-24795 CVE-2023-33460
Debian Bug     : 1040036

Multiple vulnerabilties have been found in yajl, a JSON parser / small
validating JSON generator# written in ANSI C, which potentially can
cause memory corruption or DoS.

The CVE-20117-16516 had been addressed already in DLA-3478, however the
fix has been found to be incomplete as it missed an additional memory
leak.  This update fixes that problem.


  When a crafted JSON file is supplied to yajl, the process might
  crash with a SIGABRT in the yajl_string_decode function in
  yajl_encode.c. This results potentially in a denial of service.


  The 1.x branch and the 2.x branch of `yajl` contain an integer
  overflow which leads to subsequent heap memory corruption when dealing
  with large (~2GB) inputs.


  There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse
  function, which potentially cause out-of-memory in server and cause

For Debian 10 buster, these problems have been fixed in version

We recommend that you upgrade your yajl packages.

For the detailed security status of yajl please refer to
its security tracker page at:

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Attachment: signature.asc
Description: PGP signature

Reply to: