CVE-2022-24836

CVE-2022-24836 affects Nokogiri, a Ruby HTML/XML parser. The issue is an inefficient regular expression used to detect encoding in HTML documents in versions = 1.13.4 (or applicable patches) as noted in multiple sources (Debian/Alpine/Amazon/DLA advisories and vendor notices). If upgrade is not p...

CVE-2021-28965 affecting package ruby for versions less than 2.7.4-1

CVE-2021-28965 affecting package ruby for versions less than 2.7.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-32066 affecting package ruby for versions less than 2.7.4-1

CVE-2021-32066 affecting package ruby for versions less than 2.7.4-1. An upgraded version of the package is available that resolves this issue...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit integer wrapping to 0 when need...

Denial Of Service (DoS)

yajl-ruby is vulnerable to denial of service. The vulnerability exists due to an integer overflow which leads to a heap memory corruption causing an application crash...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the internal string conversion methods like KernelFloat and Stringtof. An attacker can cause a crash or access unintended memory by providing specially crafted input. Remediation A fix was pushed into the master...

AZL-10552 CVE-2022-24795 affecting package rubygem-yajl-ruby for versions less than 1.3.1-2

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

DEBIAN-CVE-2022-24795

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

CVE-2022-24795

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

AZL-35233 CVE-2022-24795 affecting package rubygem-yajl-ruby for versions less than 1.4.3-1

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

Integer overflow

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

UBUNTU-CVE-2022-24795

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

CVE-2022-24795

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

GHSA-JJ47-X69X-MXRM Buffer Overflow in yajl-ruby

NOTE: A previous patch, 1.4.2, fixed the heap memory issue, but could still lead to a DoS infinite loop. Please update to version 1.4.3 The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. Detail...

Buffer Overflow in yajl-ruby

NOTE: A previous patch, 1.4.2, fixed the heap memory issue, but could still lead to a DoS infinite loop. Please update to version 1.4.3 The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. Detail...

Ruby on Rails: Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag

It seems to be a problem caused by a difference between the nokogiri java implementation and the ruby implementation. It seems to be an ambiguous case as to whether to do it with nokogiri or have rails-html-sanitizer defend it. jruby9.3.3.0 nokogiri java, use...

yajl-ruby 安全漏洞

yajl-ruby is a streaming JSON parsing and encoding library for Ruby by Brian Lopez, an individual developer in the United States. A security vulnerability exists in yajl-ruby that originates from a heap memory corruption when processing input larger than 2GB...

CVE-2022-24795

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

PT-2022-7111 · Yajl-Ruby +10 · Yajl-Ruby +10

Name of the Vulnerable Software and Affected Versions: yajl-ruby versions 1.x through 2.x Description: The issue is related to an integer overflow in the yajl-ruby library, which leads to heap memory corruption when dealing with large inputs 2GB. The reallocation logic at yajl buf.cL64 may result...

CVE-2022-24795

The CVE-2022-24795 issue affects yajl (and its ruby binding yajl-ruby). A 32-bit size_t-based integer overflow in the reallocation logic (yajl_buf.c) can cause under-allocation when handling very large inputs (~2 GB), leading to heap memory corruption and potential process availability impact. On...