| Summary: | dev-perl/YAML-LibYAML: Wrapped strings cause assert failure | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | trivial | CC: | perl |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bitbucket.org/xi/libyaml/issue/10/wrapped-strings-cause-assert-failure | ||
| Whiteboard: | ~3 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
+*YAML-LibYAML-0.590.0 (03 Jun 2015) + + 03 Jun 2015; Patrice Clement <monsieurp@gentoo.org> + +YAML-LibYAML-0.590.0.ebuild: + Version bump. Fix security bug 531848. + + 03 Jun 2015; Patrice Clement <monsieurp@gentoo.org> + -YAML-LibYAML-0.410.0.ebuild, -YAML-LibYAML-0.520.0.ebuild: + Remove vulnerable versions. Fix security bug 531848. + Thanks, closing noglsa |
From ${URL} : Hi, I found an edge case in scanner that results in an assert() failing. The document is: abc: def: 'xxx ' ghi: 'yyy' And the issue is caused by that line-wrapped 'xxx'. The next entry needs to be aligned with the first otherwise it's just a normal parsing failure. Result: [1] Parsing 'crashtest': lt-run-parser: scanner.c:1113: yaml_parser_save_simple_key: Assertion `parser->simple_key_allowed || !required' failed. fixed in 0.53 @maintainer(s): since the package or the affected version has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.