Ubuntu 13.10 USN-2098-2 Moderate: LibYAML Denial Of Service Issue

ubuntu

February 13, 2014

USN-2098-1 introduced a regression in LibYAML.

Summary

USN-2098-1 introduced a regression in LibYAML.

Software Description:

- libyaml: Fast YAML 1.1 parser and emitter library

Details:

USN-2098-1 fixed a vulnerability in LibYAML. The security fix used

introduced a regression that caused parsing failures for certain valid YAML

files. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Florian Weimer discovered that LibYAML incorrectly handled certain large

yaml documents. An attacker could use this issue to cause LibYAML to crash,

resulting in a denial of service, or possibly execute arbitrary code.

Topics Covered

security advisory moderate denial of service ubuntu performance issue libyaml

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  libyaml-0-2                     0.1.4-2ubuntu0.13.10.2

Ubuntu 12.10:
  libyaml-0-2                     0.1.4-2ubuntu0.12.10.2

Ubuntu 12.04 LTS:
  libyaml-0-2                     0.1.4-2ubuntu0.12.04.2

After a standard system update you need to restart applications using
LibYAML to make all the necessary changes.