Lucene search

K
centosCentOS ProjectCESA-2015:0100
HistoryJan 28, 2015 - 10:40 p.m.

libyaml security update

2015-01-2822:40:28
CentOS Project
lists.centos.org
52

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.018 Low

EPSS

Percentile

88.1%

CentOS Errata and Security Advisory CESA-2015:0100

YAML is a data serialization format designed for human readability and
interaction with scripting languages. LibYAML is a YAML parser and emitter
written in C.

An assertion failure was found in the way the libyaml library parsed
wrapped strings. An attacker able to load specially crafted YAML input into
an application using libyaml could cause the application to crash.
(CVE-2014-9130)

All libyaml users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. All running applications
linked against the libyaml library must be restarted for this update to
take effect.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2015-January/083071.html
https://lists.centos.org/pipermail/centos-announce/2015-January/083079.html

Affected packages:
libyaml
libyaml-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2015:0100

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.018 Low

EPSS

Percentile

88.1%