------------------------------------------------------------------------- Debian LTS Advisory DLA-3516-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Sean Whitton August 05, 2023 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : burp Version : 2.1.32-2+deb10u1 CVE ID : CVE-2017-16516 CVE-2022-24795 CVE-2023-33460 Debian Bug : 1040036 Multiple vulnerabilities have been found in the version of yajl bundled with burp, a simple cross-platform network BackUp and Restore Program. yajl is a JSON parser and small validating JSON generator. CVE-2017-16516 When a crafted JSON file is supplied to yajl, the process might crash with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This potentially results in a denial of service. CVE-2022-24795 The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. CVE-2023-33460 There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function, which potentially cause the server to run out of memory and crash. For Debian 10 buster, this problem has been fixed in version 2.1.32-2+deb10u1. We recommend that you upgrade your burp packages. For the detailed security status of burp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/burp Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature