Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.0307
libyaml-libyaml-perl security update
10 March 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libyaml-libyaml-perl
Publisher: Debian
Operating System: Debian GNU/Linux 6
Debian GNU/Linux 7
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2013-6393
Reference: ESB-2014.0130.2
Original Bulletin:
http://www.debian.org/security/2014/dsa-2870
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2870-1 security@debian.org
http://www.debian.org/security/ Salvatore Bonaccorso
March 08, 2014 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : libyaml-libyaml-perl
Vulnerability : heap-based buffer overflow
CVE ID : CVE-2013-6393
Florian Weimer of the Red Hat Product Security Team discovered a
heap-based buffer overflow flaw in LibYAML, a fast YAML 1.1 parser and
emitter library. A remote attacker could provide a YAML document with a
specially-crafted tag that, when parsed by an application using libyaml,
would cause the application to crash or, potentially, execute arbitrary
code with the privileges of the user running the application.
This update corrects this flaw in the copy that is embedded in the
libyaml-libyaml-perl package.
For the oldstable distribution (squeeze), this problem has been fixed in
version 0.33-1+squeeze2.
For the stable distribution (wheezy), this problem has been fixed in
version 0.38-3+deb7u1.
For the testing distribution (jessie), this problem has been fixed in
version 0.41-4.
For the unstable distribution (sid), this problem has been fixed in
version 0.41-4.
We recommend that you upgrade your libyaml-libyaml-perl packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJTGxHlAAoJEAVMuPMTQ89EbtQQAKD9QG9kNJTuFl0P777wSyAR
gQzzFjOGPP+p9Q3OWewXK2Xfk6fb6eBRk2vI3TZ63XD3KPPebhfMvRGHILp1jscI
hab6pHbp2Bs6PcX+ahEUfVhnv+7J+RxNEjjl5RWMIznUCM6G5tX4xjAbaKTnAUSZ
cbGHc3agtNXxQLGdW1eLedIZjWqVtkPQ3q7UbGl8dXbP8s1XWc0N+LJZDskFYfUT
/99qX122gFOpNPI9YGuosa+I5J0LWCJz/+qN00wx5K5uipsV52wgR4Kq+xMLV545
A1sPTpNiNkOrIvXQiWLP6JrLV39gb0G09dBCn6veCmhiagBvkSY5A8/wWphiG9k1
OKpwqYp1rFxWEpCgImU3TqiZutIM/yKopJPa+Lz4ZAb6yI62411hati7f6gqdYk1
GU3cJsPMQQ4Xz7Uj0po2gZ76UNo5skYsdOdunQv3foWDVoRNkHB1BbTsrQFBUD3u
zbih3vhLmK01lvgNYDTyhJodtCfRJumMn6o0zaWBEYOVpD7GzwABxECyDwSe626D
bs8QXWPuK5DaJ/XkntmswRkeJ3NBsGVwaZUszmTPCLLX/XEPDQls1yuYnPCUvo/4
+hNTlkEwpzW1x1G1Kpd7m2j7KsS6xpAgnt90B0RHPrTtS63xEGIgk3Z5301yxzcE
OjzJ2ZxxdRIEU6fMgC0W
=fvig
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUx0TtxLndAQH1ShLAQLN5Q//d2MOTXVgayRkpvliZOds65QIUEql6EKt
7wi8OvCc3erKEPmARxuUzCO7Nr10UbMANEOByREGOueTTWS3Up3Mum5ceS2m3+Sj
Lklk0NuPG/2rwoiOt4P4YdmoNKa7JArRMAtGJjYoo2GfQ4NZyhSOqT60FNKqgzUL
rVQxOB8UsNP9VfmdDosi5z/yXkOCPK9s3Cjj21tjJt43KBjBeX7y0LS1LUJNrNS4
OP3LcvZWO6yL2Jp6B8LK9tWdrDnP86K3TMsnCLTW/9/G40ADgq7fsTadDcqf7S1T
h/K8fgWprTn6LivO70cD1YiLEX9H/sgHMcJ2JxFvKpXOA7u5YVMrAFWCEci9ElmM
OU8Y2csL13opJjoWMOWXjHiSS0PGyYfdXM6mBbDp7mq4JYz2QIBgOjJB6r4UrWED
rQJ/0PKJ10koxXd8pXZHZeQcUTIr539MfG0pG+AfejZDTegdzXfkBy3VS9zCIRy8
EmbDo2QhSjv5ZIVnfP4C3Zlh3eSFRDhH2RRma7FVQhmHsw5c2qoxHjL3Ay9FyRCf
k7DI3X9ZtW3O6z7uiCKbH2VoS2azlPBQTyHigKB0rB7Jnq3tzkQOokxbNe1b4fL1
oKcF1e0zNBBuLwwQV+afMhp6nw4hcN9tjIWaCTSgeAXM7Co7x4PTkIMMVYH+jJQU
f8UlnlEpKAs=
=1wCB
-----END PGP SIGNATURE-----