CVE-2024-35325

2024-06-1300:00:00

ubuntu.com

vulnerability

libyaml

0.2.5

double-free

yaml_event_delete

golang-goyaml

design flaws

unix

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

A vulnerability was found in libyaml up to 0.2.5. Affected by this issue is
the function yaml_event_delete of the file /src/libyaml/src/api.c. The
manipulation leads to a double-free.

Bugs

<https://github.com/yaml/libyaml/issues/297>

Notes

Author	Note
jdstrand	golang-goyaml is a go translation of libyaml and shouldn’t share implementation flaws, but may share design flaws
mdeslaur	This is a misuse of the API per the upstream libyaml developers. This CVE is likely to get rejected, marking as deferred to make sure.

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchgolang-goyaml< anyUNKNOWN
ubuntu18.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu20.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu22.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu23.10noarchgolang-yaml.v2< anyUNKNOWN
ubuntu24.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu16.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu18.04noarchlibyaml< anyUNKNOWN
ubuntu20.04noarchlibyaml< anyUNKNOWN
ubuntu22.04noarchlibyaml< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	16.04	noarch	golang-goyaml	< any	UNKNOWN
ubuntu	18.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	20.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	22.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	23.10	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	24.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	16.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	18.04	noarch	libyaml	< any	UNKNOWN
ubuntu	20.04	noarch	libyaml	< any	UNKNOWN
ubuntu	22.04	noarch	libyaml	< any	UNKNOWN