UbuntuUpdates.org

Package "yajl-tools"

Name: yajl-tools

Description:

Yet Another JSON Library - tools
Latest version: 2.1.0-3ubuntu0.20.04.1
Release: focal (20.04)
Level: security
Repository: universe
Head package: yajl
Homepage: http://lloyd.github.com/yajl/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "yajl-tools"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "yajl-tools" in Focal

Repository Area Version
base universe 2.1.0-3
updates universe 2.1.0-3ubuntu0.20.04.1

Changelog

Version: 2.1.0-3ubuntu0.20.04.1 2023-12-14 17:07:02 UTC

  yajl (2.1.0-3ubuntu0.20.04.1) focal-security; urgency=medium

  * SECURITY UPDATE: buffer overread in yajl_string_decode function
    - debian/patches/CVE-2017-16516.patch: don't advance our end pointer until
      we've checked we have enough buffer left and that the unicode escape is
      approaching.
    - CVE-2017-16516
  * SECURITY UPDATE: integer overflow leading to heap memory corruption when
    processing large (~2GB) inputs
    - debian/patches/CVE-2022-24795.patch: catch integer overflow and
      terminate the process with abort().
    - CVE-2022-24795
  * SECURITY UPDATE: memory leak in yajl_tree_parse function
    - debian/patches/CVE-2023-33460.patch: fix memory leak problems by
      releasing requested memory in time.
    - CVE-2023-33460

 -- Fabian Toepfer <email address hidden> Thu, 14 Dec 2023 14:06:36 +0100
CVE-2017-16516 In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in
CVE-2022-24795 yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow whi
CVE-2023-33460 There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.


About   -   Send Feedback to @ubuntu_updates