MGASA-2024-0066

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2024-0066.html
Import Source
https://advisories.mageia.org/MGASA-2024-0066.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2024-0066
Related
Published
2024-03-15T22:51:55Z
Modified
2024-03-15T22:39:30Z
Summary
Updated yajl packages fix security vulnerabilities
Details

The updated packages fix security vulnerabilities: In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajlstringdecode function in yajlencode.c. This results in the whole ruby process terminating and potentially a denial of service. (CVE-2017-16516) There's a memory leak in yajl 2.1.0 with use of yajltree_parse function. which will cause out-of-memory in server and cause crash. (CVE-2023-33460)

References
Credits

Affected packages

Mageia:9 / yajl

Package

Name
yajl
Purl
pkg:rpm/mageia/yajl?distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.1.0-6.1.mga9

Ecosystem specific 

{
    "section": "core"
}