[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 3516-1] burp security update

Debian LTS Advisory DLA-3516-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                         Sean Whitton
August 05, 2023                               https://wiki.debian.org/LTS

Package        : burp
Version        : 2.1.32-2+deb10u1
CVE ID         : CVE-2017-16516 CVE-2022-24795 CVE-2023-33460
Debian Bug     : 1040036

Multiple vulnerabilities have been found in the version of yajl bundled
with burp, a simple cross-platform network BackUp and Restore Program.
yajl is a JSON parser and small validating JSON generator.


  When a crafted JSON file is supplied to yajl, the process might
  crash with a SIGABRT in the yajl_string_decode function in
  yajl_encode.c.  This potentially results in a denial of service.


  The 1.x branch and the 2.x branch of `yajl` contain an integer
  overflow which leads to subsequent heap memory corruption when dealing
  with large (~2GB) inputs.


  There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse
  function, which potentially cause the server to run out of memory and

For Debian 10 buster, this problem has been fixed in version

We recommend that you upgrade your burp packages.

For the detailed security status of burp please refer to
its security tracker page at:

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Attachment: signature.asc
Description: PGP signature

Reply to: