USN-6233-1: YAJL vulnerabilities

Releases

• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• yajl - Yet Another JSON Library

Details

It was discovered that YAJL was not properly performing bounds checks when
decoding a string with escape sequences. If a user or automated system
using YAJL were tricked into processing specially crafted input, an
attacker could possibly use this issue to cause a denial of service
(application abort). (CVE-2017-16516)

It was discovered that YAJL was not properly handling memory allocation
when dealing with large inputs, which could lead to heap memory
corruption. If a user or automated system using YAJL were tricked into
running a specially crafted large input, an attacker could possibly use
this issue to cause a denial of service. (CVE-2022-24795)

It was discovered that memory leaks existed in one of the YAJL parsing
functions. An attacker could possibly use this issue to cause a denial of
service (memory exhaustion). (CVE-2023-33460)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04

• libyajl2 - 2.1.0-2ubuntu0.18.04.1~esm1
  Available with Ubuntu Pro

Ubuntu 16.04

• libyajl2 - 2.1.0-2ubuntu0.16.04.1~esm1
  Available with Ubuntu Pro

Ubuntu 14.04

• libyajl2 - 2.0.4-4ubuntu0.1~esm1
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-33460
• CVE-2022-24795
• CVE-2017-16516

Related notices

• USN-6233-2: yajl, libyajl-doc, libyajl2, libyajl-dev, yajl-tools