-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Tue, 11 Jul 2023 19:55:30 +0200 Source: yajl Architecture: source Version: 2.1.0-3+deb11u2 Distribution: bullseye Urgency: medium Maintainer: John Stamp <jstamp@users.sourceforge.net> Changed-By: Tobias Frost <tobi@debian.org> Closes: 1039984 1040036 Changes: yajl (2.1.0-3+deb11u2) bullseye; urgency=medium . [Tobias Frost] * Non-maintainer upload. * Cherry pick John's CVE fixes from 2.1.0-4 and 2.1.0-5: - CVE-2017-16516: Potential in a denial of service with crafted JSON file - CVE-2022-24795: integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. - CVE-2023-33460: memory leak which potentially can lead to a out-of- memory situation and cause a crash. . [John Stamp] * Patch CVE-2017-16516 and CVE-2022-24795 (Closes: #1040036) * The patch for CVE-2023-33460 turned out to be incomplete. Fix that. (Closes: #1039984) Checksums-Sha1: aac9ad12d9a96cf7f143dd2519d8eabde9f8ffd0 1980 yajl_2.1.0-3+deb11u2.dsc ef79354e2721a96be367b8e809baead570c12924 7052 yajl_2.1.0-3+deb11u2.debian.tar.xz c76501121b4057271c957f2bbed9cf512dbf2726 8644 yajl_2.1.0-3+deb11u2_amd64.buildinfo Checksums-Sha256: 2ba7f52774411086f7f082cdd7e7928f081216aa596c9660b5ad3de9ba875711 1980 yajl_2.1.0-3+deb11u2.dsc e942586d6f7990304843050d50d843734fd608f0a3f6b48660972cd93e888799 7052 yajl_2.1.0-3+deb11u2.debian.tar.xz 73ca068f275aee58fc338772cc6106e7e8110a2f47a2d74f52d8e29813920da3 8644 yajl_2.1.0-3+deb11u2_amd64.buildinfo Files: d8b1bc027f7e03ec2b13bf0029407b94 1980 libs optional yajl_2.1.0-3+deb11u2.dsc 148b03e929b561f70bfe86cc01b91eb3 7052 libs optional yajl_2.1.0-3+deb11u2.debian.tar.xz 29a846e44b783f13c0055245aa20ccbc 8644 libs optional yajl_2.1.0-3+deb11u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE/d0M/zhkJ3YwohhskWT6HRe9XTYFAmS9TnEACgkQkWT6HRe9 XTYZBg//fHytlnzn1HUfU4g9rejP/GaYZtKEs8O82zmD++Y8IsFqSuRl1eYgfFuq wfCudAsmm3UUFjFMCGIjjo6IiMrB8017nXPdOP3EVnE6EhoeHBary7kLPrR2Dz06 t4NnohkNz/slrv/S1CGMjzMXxvAqlKOmUD7cEVVjmh9Kl2S+8Lhh/RFiMJnVSDpi 2c3Rps4ulm3Szyi6q6reLmPDJv2gUwSVhvEkMIiL071ayDzbCmh7A4XtGNCvjAee C4ZaEQ5BiY62jmJE6knVTOCHSAhli72tiAdf7d4SDHiXchnai6alAlvR07JaNXFi lnc5mnhvg+zhYRnXUJLXVpxJqOH3v3SfLGAMvpoMxUIF/gnSu3zVJw+A6YBn+M30 e2+87U8T6mMck6vjZfzZTr1eteFvpsRbcaFRONAMyEXALj68ByKydu7lIFTsMXo9 LVBCiNirYpEq8Ae7fzvzSvYi1Q2r45sRlF9xu+G5QaMpMlb47mGSLp4XLFLoqudg drMlDlVToRV6qdF5KSlRmJ0go4/A2f09qvmFbn/Q8Sz0o/yVw0zZar83chIwO1rJ HnE/gYFPO/+sGfULM1yhW7X3bIe/dhGg8pV7455jcUQVTE02BQPpm3cevuKlCkeD UFY2ZyE31gdvsEDxgbXgnnkeho+NYBc4qI3cdCdpVG0TV7AX1z4= =a8/U -----END PGP SIGNATURE-----
