USN-6233-1: YAJL vulnerabilities
18 July 2023
Several security issues were fixed in YAJL.
Releases
Packages
- yajl - Yet Another JSON Library
Details
It was discovered that YAJL was not properly performing bounds checks when
decoding a string with escape sequences. If a user or automated system
using YAJL were tricked into processing specially crafted input, an
attacker could possibly use this issue to cause a denial of service
(application abort). (CVE-2017-16516)
It was discovered that YAJL was not properly handling memory allocation
when dealing with large inputs, which could lead to heap memory
corruption. If a user or automated system using YAJL were tricked into
running a specially crafted large input, an attacker could possibly use
this issue to cause a denial of service. (CVE-2022-24795)
It was discovered that memory leaks existed in one of the YAJL parsing
functions. An attacker could possibly use this issue to cause a denial of
service (memory exhaustion). (CVE-2023-33460)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04
-
libyajl2
-
2.1.0-2ubuntu0.18.04.1~esm1
Available with Ubuntu Pro
Ubuntu 16.04
-
libyajl2
-
2.1.0-2ubuntu0.16.04.1~esm1
Available with Ubuntu Pro
Ubuntu 14.04
-
libyajl2
-
2.0.4-4ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-6233-2: yajl-tools, yajl, libyajl-doc, libyajl-dev, libyajl2