CVE-2024-35326

2024-06-1300:00:00

ubuntu.com

libyaml

buffer overflow

yaml_emitter_emit

double-free

golang-goyaml

design flaws

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

libyaml v0.2.5 is vulnerable to Buffer Overflow. Affected by this issue is
the function yaml_emitter_emit of the file /src/libyaml/src/emitter.c. The
manipulation leads to a double-free.

Notes

Author	Note
jdstrand	golang-goyaml is a go translation of libyaml and shouldn’t share implementation flaws, but may share design flaws
mdeslaur	There are no details about a fix for this vulnerability or a comment from the upstream developers as of 2024-06-19, but like the other CVEs from the same reporter this is likely a misuse of the API and the CVE will likely get rejected. Marking as deferred for now to make sure.

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchgolang-goyaml< anyUNKNOWN
ubuntu18.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu20.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu22.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu23.10noarchgolang-yaml.v2< anyUNKNOWN
ubuntu24.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu16.04noarchgolang-yaml.v2< anyUNKNOWN
ubuntu18.04noarchlibyaml< anyUNKNOWN
ubuntu20.04noarchlibyaml< anyUNKNOWN
ubuntu22.04noarchlibyaml< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	16.04	noarch	golang-goyaml	< any	UNKNOWN
ubuntu	18.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	20.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	22.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	23.10	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	24.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	16.04	noarch	golang-yaml.v2	< any	UNKNOWN
ubuntu	18.04	noarch	libyaml	< any	UNKNOWN
ubuntu	20.04	noarch	libyaml	< any	UNKNOWN
ubuntu	22.04	noarch	libyaml	< any	UNKNOWN