PT-2024-24377 · Libyaml · Libyaml

Published 2024-04-02 · Updated 2024-10-18 · CVE-2024-3205

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions libyaml versions up to 0.2.5

Description A critical vulnerability was found in libyaml, affecting the yaml emitter emit flow sequence item function. This issue leads to a heap-based buffer overflow and may be exploited remotely. The exploit has been publicly disclosed.

Recommendations For libyaml versions up to 0.2.5: Update libyaml and apply the latest patches to resolve the issue. As a temporary workaround, consider restricting the use of the yaml emitter emit flow sequence item function until a patch is available.

Related Identifiers

CVE-2024-3205

OESA-2024-1551

OESA-2024-1578

OESA-2024-2276

OESA-2024-2277

Affected Products

Libyaml

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-3205 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2277 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1551 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2276 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1578 · Vendor Advisory
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1578 · Note
• https://twitter.com/oktsec/status/1778423287187460427 · Twitter Post
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2277 · Note
• https://twitter.com/CVEnew/status/1775295230813646943 · Twitter Post
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1551 · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2276 · Note
• https://t.me/cvenotify/75569 · Telegram Post